Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:file.exe
Analysis ID:1528363
MD5:e5dee324e4d2c335dc57f68ab1230b91
SHA1:f12babfaa76b5466b3464b6f7e164a16997a08e9
SHA256:e1cb3fa706ea73b4ac3d0d19305f935c60ec02466955b08cd959008675d007aa
Tags:exeuser-Bitsight
Infos:

Detection

Credential Flusher
Score:64
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Yara detected Credential Flusher
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Found API chain indicative of sandbox detection
Machine Learning detection for sample
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected non-DNS traffic on DNS port
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
Potential key logger detected (key state polling based)
Sample execution stops while process was sleeping (likely an evasion)
Sleep loop found (likely to delay execution)
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Uses taskkill to terminate processes

Classification

Process Tree

  • System is w10x64
  • file.exe (PID: 4192 cmdline: "C:\Users\user\Desktop\file.exe" MD5: E5DEE324E4D2C335DC57F68AB1230B91)
    • taskkill.exe (PID: 2944 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)
      • conhost.exe (PID: 1456 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • taskkill.exe (PID: 4956 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)
      • conhost.exe (PID: 2736 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • taskkill.exe (PID: 180 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)
      • conhost.exe (PID: 6728 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • taskkill.exe (PID: 6724 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)
      • conhost.exe (PID: 2496 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • taskkill.exe (PID: 6096 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)
      • conhost.exe (PID: 2844 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • chrome.exe (PID: 7164 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 7220 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=2008,i,16001963965146608376,17466102332235184443,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 8100 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5356 --field-trial-handle=2008,i,16001963965146608376,17466102332235184443,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 8108 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 --field-trial-handle=2008,i,16001963965146608376,17466102332235184443,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
Process Memory Space: file.exe PID: 4192JoeSecurity_CredentialFlusherYara detected Credential FlusherJoe Security

    Sigma Signatures

    ⊘No Sigma rule has matched

    Suricata Signatures

    ⊘No Suricata rule has matched

    Joe Sandbox Signatures

    Click to jump to signature section

    Show All Signature Results

    AV Detection

    barindex
    AI detected suspicious sample
    Source: Submited SampleIntegrated Neural Analysis Model: Matched 96.3% probability
    Machine Learning detection for sample
    Source: file.exeJoe Sandbox ML: detected
    Source: file.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
    Source: unknownHTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.4:49769 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.4:60167 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.4:60168 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.4:60192 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.4:60368 version: TLS 1.2
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AEDBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,0_2_00AEDBBE
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AF68EE FindFirstFileW,FindClose,0_2_00AF68EE
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AF698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,0_2_00AF698F
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AED076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_00AED076
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AED3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_00AED3A9
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AF9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00AF9642
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AF979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00AF979D
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AF9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00AF9B2B
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AF5C97 FindFirstFileW,FindNextFileW,FindClose,0_2_00AF5C97
    Source: global trafficTCP traffic: 192.168.2.4:60162 -> 1.1.1.1:53
    Source: Joe Sandbox ViewIP Address: 239.255.255.250 239.255.255.250
    Source: Joe Sandbox ViewJA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
    Source: unknownTCP traffic detected without corresponding DNS query: 173.222.162.32
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 93.184.221.240
    Source: unknownTCP traffic detected without corresponding DNS query: 93.184.221.240
    Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
    Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
    Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
    Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
    Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
    Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
    Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
    Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
    Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
    Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
    Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
    Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
    Source: unknownTCP traffic detected without corresponding DNS query: 13.107.246.60
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AFCE44 InternetReadFile,SetEvent,GetLastError,SetEvent,0_2_00AFCE44
    Source: global trafficHTTP traffic detected: GET /account?=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fchallenge%2Fpwd HTTP/1.1Host: www.youtube.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: YSC=S5HctmVlfJE
    Source: global trafficHTTP traffic detected: GET /accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-560230264&timestamp=1728326769600 HTTP/1.1Host: accounts.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: global trafficHTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=518=l6RhwBIEnQ0sdkLit3GV36k4WWPtKRXXI_zxtvmrJYfUl7HHRnOlDlNPSVQiUi3A5RIxxrsUl1voIWoa4Nd13AoC7YmntBUvy6vLYfAGPTzaq5_bWC1B4TSysCwDglrBVjSmkxBolXQq2q0i1aBcQEcuWWGSL4zdimp5AoCaJ8avbJkrpJU
    Source: global trafficHTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=hRm6SBNxBBMyyht&MD=xmKsWxeB HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
    Source: global trafficHTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=hRm6SBNxBBMyyht&MD=xmKsWxeB HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
    Source: global trafficHTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: global trafficHTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
    Source: chromecache_137.13.drString found in binary or memory: _.iq(p)+"/familylink/privacy/notice/embedded?langCountry="+_.iq(p);break;case "PuZJUb":a+="https://www.youtube.com/t/terms?chromeless=1&hl="+_.iq(m);break;case "fxTQxb":a+="https://youtube.com/t/terms?gl="+_.iq(_.rq(c))+"&hl="+_.iq(d)+"&override_hl=1"+(f?"&linkless=1":"");break;case "prAmvd":a+="https://www.google.com/intl/"+_.iq(m)+"/chromebook/termsofservice.html?languageCode="+_.iq(d)+"&regionCode="+_.iq(c);break;case "NfnTze":a+="https://policies.google.com/privacy/google-partners"+(f?"/embedded": equals www.youtube.com (Youtube)
    Source: global trafficDNS traffic detected: DNS query: youtube.com
    Source: global trafficDNS traffic detected: DNS query: www.youtube.com
    Source: global trafficDNS traffic detected: DNS query: www.google.com
    Source: global trafficDNS traffic detected: DNS query: accounts.youtube.com
    Source: global trafficDNS traffic detected: DNS query: play.google.com
    Source: unknownHTTP traffic detected: POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 518sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"Content-Type: application/x-www-form-urlencoded;charset=UTF-8sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"X-Goog-AuthUser: 0sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*Origin: https://accounts.google.comX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
    Source: chromecache_137.13.drString found in binary or memory: https://accounts.google.com
    Source: chromecache_137.13.drString found in binary or memory: https://accounts.google.com/TOS?loc=
    Source: chromecache_149.13.drString found in binary or memory: https://apis.google.com/js/api.js
    Source: chromecache_137.13.drString found in binary or memory: https://apis.google.com/js/rpc:shindig_random.js?onload=credentialservice.postMessage
    Source: chromecache_137.13.drString found in binary or memory: https://families.google.com/intl/
    Source: chromecache_149.13.drString found in binary or memory: https://fonts.gstatic.com/s/i/productlogos/drive_2020q4/v10/192px.svg
    Source: chromecache_149.13.drString found in binary or memory: https://fonts.gstatic.com/s/i/productlogos/gmail_2020q4/v10/web-48dp/logo_gmail_2020q4_color_2x_web_
    Source: chromecache_149.13.drString found in binary or memory: https://fonts.gstatic.com/s/i/productlogos/maps/v7/192px.svg
    Source: chromecache_137.13.drString found in binary or memory: https://g.co/recover
    Source: chromecache_137.13.drString found in binary or memory: https://play.google.com/log?format=json&hasfast=true
    Source: chromecache_137.13.drString found in binary or memory: https://play.google.com/work/enroll?identifier=
    Source: chromecache_137.13.drString found in binary or memory: https://play.google/intl/
    Source: chromecache_137.13.drString found in binary or memory: https://policies.google.com/privacy
    Source: chromecache_137.13.drString found in binary or memory: https://policies.google.com/privacy/additional
    Source: chromecache_137.13.drString found in binary or memory: https://policies.google.com/privacy/google-partners
    Source: chromecache_137.13.drString found in binary or memory: https://policies.google.com/technologies/cookies
    Source: chromecache_137.13.drString found in binary or memory: https://policies.google.com/technologies/location-data
    Source: chromecache_137.13.drString found in binary or memory: https://policies.google.com/terms
    Source: chromecache_137.13.drString found in binary or memory: https://policies.google.com/terms/location
    Source: chromecache_137.13.drString found in binary or memory: https://policies.google.com/terms/service-specific
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/account-recovery-email-pin.gif
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/account-recovery-password.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/account-recovery-sms-or-voice-pin.gif
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/account-recovery-sms-pin.gif
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/account-recovery-stop-go-landing-page_1x.png
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/animation/
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/ble_device.png
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/ble_pin.png
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/contacts_backup_sync.png
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/contacts_backup_sync_1x.png
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/contacts_backup_sync_2x.png
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/contacts_backup_sync_darkmode_1x.png
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/continue_on_your_phone.png
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/device_phone_number_verification.png
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/device_prompt_silent_tap_yes_darkmode.gif
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/device_prompt_tap_yes.gif
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/device_prompt_tap_yes_darkmode.gif
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kid_success.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kid_success_darkmode.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidfork_who_will_use_dark_v2.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidfork_who_will_use_updated.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidfork_who_will_use_updated_darkmode.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidfork_who_will_use_v2.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignin_not_ready.png
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignin_stick_around_1.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignin_stick_around_dark_1.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_child_account_1.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_child_account_darkmode_1.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_child_privacy_1.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_child_privacy_darkmode_1.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_created.png
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_double_device.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_double_device_darkmode.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_full_house.png
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_link_accounts_1.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_link_accounts_darkmode_1.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_parent_app_decision.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_parent_app_decision_darkmode.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_parent_supervision_1.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_parent_supervision_darkmode_1.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_respect_others_1.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_respect_others_darkmode_1.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_single_device.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_single_device_darkmode.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_stop.png
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/personalization_reminders.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/phone_number_sign_in_2x.png
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/return_to_desktop.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/return_to_desktop_darkmode.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/security_key.gif
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/security_key_ios_center.png
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/security_key_laptop.gif
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/security_key_nfc_discovered.gif
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/security_key_nfc_discovered_darkmode.gif
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/security_key_phone.gif
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/signin_googleapp_ios.gif
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/signin_googleapp_pulldown.gif
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/signin_tapyes.gif
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/smart_lock_2x.png
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/usb_key.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/web_and_app_activity.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/who_will_be_using_this_device.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/embedded/you_tube_history.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/feature_not_available.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/feature_not_available_dark.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/gmail_ios_authzen.gif
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/paaskey.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_challenge.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_challenge_darkmode.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_darkmode.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_cross_device.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_cross_device_darkmode.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_darkmode.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_error.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_error_darkmode.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_reauth.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_reauth_darkmode.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_success.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_success_darkmode.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkeyerror.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkeyerror_darkmode.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/red_globe_dark.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/red_globe_light.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/screenlock.png
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/security_key_ipad.gif
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/security_key_iphone.gif
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/security_key_iphone_nfc.gif
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/security_key_iphone_usb.gif
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/security_key_phone.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/security_keys.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/success_checkmark_2.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/marc/success_checkmark_2_darkmode.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/ui/loading_spinner_gm.gif
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/ui/progress_spinner_color_20dp_4x.gif
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/accounts/ui/success-gm-default_2x.png
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/apps/signup/resources/custom-email-address.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/images/hpp/shield_security_checkup_green_2x_web_96dp.png
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/chaptering/account_setup_chapter_dark_1.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/chaptering/account_setup_chapter_v1.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/chaptering/device_setup_chapter_dark_v1.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/chaptering/device_setup_chapter_v1.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/chaptering/parental_control_chapter_dark_v1.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/chaptering/parental_control_chapter_v1.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/conversion/conversion_accountslinked.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/conversion/conversion_accountslinked_dark.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/conversion/conversion_childneedshelp.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/conversion/conversion_childneedshelp_dark.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/conversion/conversion_nextstepsforparents.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/conversion/conversion_nextstepsforparents_dark.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_allset.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_allset_dark.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_apps_devices.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_apps_devices_darkmode.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_areyousurekid.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_areyousurekid_dark.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_birthdayemail.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_birthdayemail_dark.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_choose_apps.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_choose_apps_darkmode.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_confirmation.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_exploremore.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_exploremore_dark.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_intro.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_intro_darkmode.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_privacy_terms_a18.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_privacy_terms_a18_darkmode.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_privacyterms.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_privacyterms_dark.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_review_settings.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_review_settings_darkmode.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_safe_search.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_safe_search_darkmode.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_success_unchanged_a18.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_success_unchanged_a18_darkmode.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_success_update_a18.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_success_update_a18_darkmode.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_supervision_choice.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_supervision_choice_a18.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_supervision_choice_a18_darkmode.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_supervision_choice_darkmode.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_supervisiongrad.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_supervisiongrad_dark.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/guardianlinking/linking_complete_0.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/guardianlinking/linking_complete_dark_0.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/ads_personalization.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/ads_personalization_darkmode.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/confirmation.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/confirmation_darkmode.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/eligibility_error.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/eligibility_error_darkmode.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/fork.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/fork_darkmode.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/intro.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/intro_darkmode.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/personal_results.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/personal_results_darkmode.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/safe_search.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/safe_search_darkmode.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/check_notifications.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/check_notifications_dark.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_installing_family_link_2.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_installing_family_link_dark_2.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_set_up_location_sharing_2.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_set_up_location_sharing_dark_2.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_set_up_parental_controls_2.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_set_up_parental_controls_dark_2.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_set_up_school_time_2.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_set_up_school_time_dark_2.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/location_sharing_enabled_2.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/location_sharing_enabled_dark_3.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/parent_sign_in_prologue_1.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/parent_sign_in_prologue_dark_1.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_complete_1.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_complete_dark_1.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_contacts_2.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_contacts_dark_2.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_family_link_boy_1.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_family_link_boy_dark_1.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_family_link_girl_2.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_family_link_girl_dark_2.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/ulp_continue_without_gmail_dark_v2.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/ulp_continue_without_gmail_v2.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/all_set.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/all_set_dark.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/are_you_sure_parent.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/are_you_sure_parent_dark.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/content_restriction.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/content_restriction_dark.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/error.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/error_dark.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/how_controls_work.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/how_controls_work_dark.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/next_steps.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/next_steps_dark.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/setup_controls.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/setup_controls_dark.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/who_parent.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/who_parent_dark.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/who_teen.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/who_teen_dark.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/teentoadultgraduation/supervision_choice.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/teentoadultgraduation/supervision_choice_darkmode.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/ulp_appblock/kid_setup_parent_escalation.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/ulp_appblock/kid_setup_parent_escalation_dark.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/ulp_appblock/send_email_confirmation.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/ulp_appblock/send_email_confirmation_dark.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/ulp_appblock/success_sent_email.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/ulp_appblock/success_sent_email_dark.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/ulpupgrade/kidprofileupgrade_all_set.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/images/ulpupgrade/kidprofileupgrade_all_set_darkmode.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/all_set.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/all_set_dark.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/almost_done_kids_space_dark.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/almost_done_kids_space_v2.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/devices_connected_tablet_v2.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/devices_connected_tablet_v2_dark.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/devices_connected_v2.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/devices_connected_v2_dark.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/emailinstallfamilylink.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/emailinstallfamilylink_dark.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/familylinkinstalling.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/familylinkinstalling_dark.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/hand_over_device_dark_v2.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/hand_over_device_v2.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/linking_accounts_v2.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/linking_accounts_v2_dark.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/locationsetup.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/locationsetup_dark.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/manage_parental_controls_email.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/manage_parental_controls_email_v2.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/manage_parental_controls_email_v2_dark.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/manage_parental_controls_v2.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/manage_parental_controls_v2_dark.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/open_family_link_v2.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/open_family_link_v2_dark.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/parents_help.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/parents_help_dark.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/set_up_kids_space.png
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/set_up_kids_space_dark.png
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/setupcontrol.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/setupcontrol_dark.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/setuplocation.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/setuplocation_dark.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/setuptimelimits.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/setuptimelimits_dark.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/supervision_ready_v2.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/supervision_ready_v2_dark.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/youtubeaccess.svg
    Source: chromecache_149.13.drString found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/youtubeaccess_dark.svg
    Source: chromecache_137.13.drString found in binary or memory: https://support.google.com/accounts?hl=
    Source: chromecache_137.13.drString found in binary or memory: https://support.google.com/accounts?p=new-si-ui
    Source: chromecache_137.13.drString found in binary or memory: https://support.google.com/websearch/answer/4358949?hl=ko&ref_topic=3285072
    Source: chromecache_149.13.drString found in binary or memory: https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=
    Source: chromecache_137.13.drString found in binary or memory: https://www.google.com
    Source: chromecache_137.13.drString found in binary or memory: https://www.google.com/intl/
    Source: chromecache_149.13.drString found in binary or memory: https://www.gstatic.com/accounts/speedbump/authzen_optin_illustration.gif
    Source: chromecache_149.13.drString found in binary or memory: https://www.gstatic.com/images/branding/product/2x/chrome_48dp.png
    Source: chromecache_149.13.drString found in binary or memory: https://www.gstatic.com/images/branding/product/2x/googleg_48dp.png
    Source: chromecache_149.13.drString found in binary or memory: https://www.gstatic.com/images/branding/product/2x/gsa_48dp.png
    Source: chromecache_149.13.drString found in binary or memory: https://www.gstatic.com/images/branding/product/2x/play_prism_48dp.png
    Source: chromecache_149.13.drString found in binary or memory: https://www.gstatic.com/images/branding/product/2x/youtube_48dp.png
    Source: chromecache_137.13.drString found in binary or memory: https://www.gstatic.com/images/branding/productlogos/googleg/v6/36px.svg
    Source: chromecache_137.13.drString found in binary or memory: https://www.youtube.com/t/terms?chromeless=1&hl=
    Source: file.exe, 00000000.00000003.1695529510.0000000000F04000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
    Source: file.exe, 00000000.00000003.2925960228.000000000169E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2927003587.000000000169F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwduser
    Source: chromecache_137.13.drString found in binary or memory: https://youtube.com/t/terms?gl=
    Source: unknownNetwork traffic detected: HTTP traffic on port 60311 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60334 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
    Source: unknownNetwork traffic detected: HTTP traffic on port 60277 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60414 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60392 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60357 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60411
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60410
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60419
    Source: unknownNetwork traffic detected: HTTP traffic on port 60219 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60418
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60417
    Source: unknownNetwork traffic detected: HTTP traffic on port 60437 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60416
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60415
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60414
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60413
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60412
    Source: unknownNetwork traffic detected: HTTP traffic on port 60220 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60207 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60301
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60422
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60300
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60421
    Source: unknownNetwork traffic detected: HTTP traffic on port 60369 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60420
    Source: unknownNetwork traffic detected: HTTP traffic on port 60323 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60266 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60426 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60174 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60309
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60308
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60429
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60307
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60428
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60306
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60427
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60305
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60426
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60304
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60425
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60303
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60424
    Source: unknownNetwork traffic detected: HTTP traffic on port 60231 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60302
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60423
    Source: unknownNetwork traffic detected: HTTP traffic on port 60208 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60185 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60242 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60312
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60433
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60311
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60432
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60310
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60431
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60430
    Source: unknownNetwork traffic detected: HTTP traffic on port 60425 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60198 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60319
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60318
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60439
    Source: unknownNetwork traffic detected: HTTP traffic on port 60255 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60317
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60438
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60316
    Source: unknownNetwork traffic detected: HTTP traffic on port 60368 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60437
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60315
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60436
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60314
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60435
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60313
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60434
    Source: unknownNetwork traffic detected: HTTP traffic on port 60310 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60335 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60253 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60278 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60173 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60391 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60202
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60323
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60201
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60322
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60200
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60321
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60320
    Source: unknownNetwork traffic detected: HTTP traffic on port 60403 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60440
    Source: unknownNetwork traffic detected: HTTP traffic on port 60289 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60209
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60208
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60329
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60207
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60328
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60206
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60327
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60205
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60326
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60325
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60203
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60324
    Source: unknownNetwork traffic detected: HTTP traffic on port 60346 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60380 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60164 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49780
    Source: unknownNetwork traffic detected: HTTP traffic on port 60187 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60229 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60206 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60301 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60427 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60267 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60404 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60196 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60230 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60312 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60333 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60415 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60379 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60241 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60290 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60256 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60344 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49769
    Source: unknownNetwork traffic detected: HTTP traffic on port 60218 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49766
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49765
    Source: unknownNetwork traffic detected: HTTP traffic on port 60252 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
    Source: unknownNetwork traffic detected: HTTP traffic on port 60416 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60279 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60390 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60378 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60322 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60291 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60175 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60217 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60345 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60409
    Source: unknownNetwork traffic detected: HTTP traffic on port 60186 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60268 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60356 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60300 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60408
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60407
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60406
    Source: unknownNetwork traffic detected: HTTP traffic on port 60197 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60405
    Source: unknownNetwork traffic detected: HTTP traffic on port 60438 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60404
    Source: unknownNetwork traffic detected: HTTP traffic on port 60367 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60403
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60402
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60401
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60260
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60381
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60380
    Source: unknownNetwork traffic detected: HTTP traffic on port 60372 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49769 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60257
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60378
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60256
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60377
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60255
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60376
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60254
    Source: unknownNetwork traffic detected: HTTP traffic on port 60263 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60375
    Source: unknownNetwork traffic detected: HTTP traffic on port 60395 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60253
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60374
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60252
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60373
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60251
    Source: unknownNetwork traffic detected: HTTP traffic on port 60286 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60372
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60250
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60371
    Source: unknownNetwork traffic detected: HTTP traffic on port 60234 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60211 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60259
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60258
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60379
    Source: unknownNetwork traffic detected: HTTP traffic on port 60171 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60297 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60245 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60271
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60392
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60270
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60391
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60390
    Source: unknownNetwork traffic detected: HTTP traffic on port 60337 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60268
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60389
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60267
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60388
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60266
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60387
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60265
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60386
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60264
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60385
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60263
    Source: unknownNetwork traffic detected: HTTP traffic on port 60302 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60384
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60262
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60383
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60261
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60382
    Source: unknownNetwork traffic detected: HTTP traffic on port 60405 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60348 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60361 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60269
    Source: unknownNetwork traffic detected: HTTP traffic on port 60275 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60195 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60313 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60298 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60282
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60281
    Source: unknownNetwork traffic detected: HTTP traffic on port 60200 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60371 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60279
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60278
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60399
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60277
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60398
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60276
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60397
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60275
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60396
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60274
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60395
    Source: unknownNetwork traffic detected: HTTP traffic on port 60182 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60273
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60394
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60272
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60393
    Source: unknownNetwork traffic detected: HTTP traffic on port 60406 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60349 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60439 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60326 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60360 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60383 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60417 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60440 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60172
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60293
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60171
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60292
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60170
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60291
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60290
    Source: unknownNetwork traffic detected: HTTP traffic on port 60222 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60169
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60168
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60289
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60288
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60167
    Source: unknownNetwork traffic detected: HTTP traffic on port 60394 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60428 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60166
    Source: unknownNetwork traffic detected: HTTP traffic on port 60264 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60287
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60165
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60286
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60285
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60164
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60284
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60283
    Source: unknownNetwork traffic detected: HTTP traffic on port 60233 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60193 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60418 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60221 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60244 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60315 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60213
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60334
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60212
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60333
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60211
    Source: unknownNetwork traffic detected: HTTP traffic on port 60324 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60332
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60210
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60331
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60330
    Source: unknownNetwork traffic detected: HTTP traffic on port 60184 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60219
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60218
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60339
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60217
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60338
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60216
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60337
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60215
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60336
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60214
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60335
    Source: unknownNetwork traffic detected: HTTP traffic on port 60347 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60276 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60358 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60393 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60224
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60345
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60223
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60344
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60222
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60343
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60221
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60342
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60220
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60341
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60340
    Source: unknownNetwork traffic detected: HTTP traffic on port 60287 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60210 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60229
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60228
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60349
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60227
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60348
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60226
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60347
    Source: unknownNetwork traffic detected: HTTP traffic on port 60382 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60225
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60346
    Source: unknownNetwork traffic detected: HTTP traffic on port 60359 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60172 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60336 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60235
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60356
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60234
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60355
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60233
    Source: unknownNetwork traffic detected: HTTP traffic on port 60265 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60354
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60232
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60353
    Source: unknownNetwork traffic detected: HTTP traffic on port 60429 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60231
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60352
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60230
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60351
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60350
    Source: unknownNetwork traffic detected: HTTP traffic on port 60288 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60303 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60239
    Source: unknownNetwork traffic detected: HTTP traffic on port 60381 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60238
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60359
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60237
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60358
    Source: unknownNetwork traffic detected: HTTP traffic on port 60232 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60236
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60357
    Source: unknownNetwork traffic detected: HTTP traffic on port 60299 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60194 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60370
    Source: unknownNetwork traffic detected: HTTP traffic on port 60209 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60314 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60243 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60370 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60246
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60367
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60245
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60366
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60244
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60365
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60243
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60364
    Source: unknownNetwork traffic detected: HTTP traffic on port 60183 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60242
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60363
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60241
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60362
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60240
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60361
    Source: unknownNetwork traffic detected: HTTP traffic on port 60407 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60360
    Source: unknownNetwork traffic detected: HTTP traffic on port 60430 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60254 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60325 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60249
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60248
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60369
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60247
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60368
    Source: unknownNetwork traffic detected: HTTP traffic on port 60202 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60168 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60248 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60420 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60283 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49766 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60260 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60225 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60408 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60180 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60328 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60305 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60192 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49675 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60419 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60316 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60375 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60432 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60294 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60340 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60386 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60214 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60374 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60397 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60179 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60284 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60431 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60341 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60272 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60236 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60213 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60295 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60352 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60247 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60261 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49765 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60304 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60329 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60363 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60273 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60170 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60296 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60183
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60182
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60181
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60180
    Source: unknownNetwork traffic detected: HTTP traffic on port 60338 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60179
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60178
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60299
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60177
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60298
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60297
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60176
    Source: unknownNetwork traffic detected: HTTP traffic on port 60433 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60175
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60296
    Source: unknownNetwork traffic detected: HTTP traffic on port 60410 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60174
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60295
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60173
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60294
    Source: unknownNetwork traffic detected: HTTP traffic on port 60362 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60385 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60421 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60194
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60193
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60192
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60191
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60190
    Source: unknownNetwork traffic detected: HTTP traffic on port 60224 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60350 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49780 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60262 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60189
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60188
    Source: unknownNetwork traffic detected: HTTP traffic on port 60396 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60187
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60186
    Source: unknownNetwork traffic detected: HTTP traffic on port 60409 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60185
    Source: unknownNetwork traffic detected: HTTP traffic on port 60181 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60184
    Source: unknownNetwork traffic detected: HTTP traffic on port 60327 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60306 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60235 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60384 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60191 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60422 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60317 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60246 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60351 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60223 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60199
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60198
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60197
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60196
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60195
    Source: unknownNetwork traffic detected: HTTP traffic on port 60169 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60201 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60274 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60373 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60339 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60285 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60212 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60319 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60240 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 60177 -> 443
    Source: unknownHTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.4:49769 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.4:60167 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.4:60168 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.4:60192 version: TLS 1.2
    Source: unknownHTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.4:60368 version: TLS 1.2
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AFEAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,0_2_00AFEAFF
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AFED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_00AFED6A
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AFEAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,0_2_00AFEAFF
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AEAA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,0_2_00AEAA57
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00B19576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,0_2_00B19576

    System Summary

    barindex
    Binary is likely a compiled AutoIt script file
    Source: file.exeString found in binary or memory: This is a third-party compiled AutoIt script.
    Source: file.exe, 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: This is a third-party compiled AutoIt script.memstr_ee60df9a-e
    Source: file.exe, 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_3b9942b5-d
    Source: file.exeString found in binary or memory: This is a third-party compiled AutoIt script.memstr_37a0b434-1
    Source: file.exeString found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_92e16274-8
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AED5EB: CreateFileW,DeviceIoControl,CloseHandle,0_2_00AED5EB
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AE1201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,0_2_00AE1201
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AEE8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,0_2_00AEE8F6
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00A880600_2_00A88060
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AF20460_2_00AF2046
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AE82980_2_00AE8298
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00ABE4FF0_2_00ABE4FF
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AB676B0_2_00AB676B
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00B148730_2_00B14873
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AACAA00_2_00AACAA0
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00A8CAF00_2_00A8CAF0
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00A9CC390_2_00A9CC39
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AB6DD90_2_00AB6DD9
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00A9D0630_2_00A9D063
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00A891C00_2_00A891C0
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00A9B1190_2_00A9B119
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AA13940_2_00AA1394
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AA17060_2_00AA1706
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AA781B0_2_00AA781B
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AA19B00_2_00AA19B0
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00A879200_2_00A87920
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00A9997D0_2_00A9997D
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AA7A4A0_2_00AA7A4A
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AA7CA70_2_00AA7CA7
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AA1C770_2_00AA1C77
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AB9EEE0_2_00AB9EEE
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00B0BE440_2_00B0BE44
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AA1F320_2_00AA1F32
    Source: C:\Users\user\Desktop\file.exeCode function: String function: 00A9F9F2 appears 31 times
    Source: C:\Users\user\Desktop\file.exeCode function: String function: 00AA0A30 appears 46 times
    Source: file.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
    Source: classification engineClassification label: mal64.troj.evad.winEXE@51/30@12/6
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AF37B5 GetLastError,FormatMessageW,0_2_00AF37B5
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AE10BF AdjustTokenPrivileges,CloseHandle,0_2_00AE10BF
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AE16C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,0_2_00AE16C3
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AF51CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,0_2_00AF51CD
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00B0A67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,0_2_00B0A67C
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AF648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,0_2_00AF648E
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00A842A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,0_2_00A842A2
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1456:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2736:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2496:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6728:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2844:120:WilError_03
    Source: file.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
    Source: C:\Windows\SysWOW64\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
    Source: C:\Windows\SysWOW64\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
    Source: C:\Windows\SysWOW64\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
    Source: C:\Windows\SysWOW64\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
    Source: C:\Windows\SysWOW64\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
    Source: C:\Users\user\Desktop\file.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
    Source: unknownProcess created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
    Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
    Source: C:\Windows\SysWOW64\taskkill.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
    Source: C:\Windows\SysWOW64\taskkill.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
    Source: C:\Windows\SysWOW64\taskkill.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
    Source: C:\Windows\SysWOW64\taskkill.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
    Source: C:\Windows\SysWOW64\taskkill.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\Desktop\file.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=2008,i,16001963965146608376,17466102332235184443,262144 /prefetch:8
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5356 --field-trial-handle=2008,i,16001963965146608376,17466102332235184443,262144 /prefetch:8
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 --field-trial-handle=2008,i,16001963965146608376,17466102332235184443,262144 /prefetch:8
    Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /TJump to behavior
    Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /TJump to behavior
    Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /TJump to behavior
    Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /TJump to behavior
    Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /TJump to behavior
    Source: C:\Users\user\Desktop\file.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobarsJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=2008,i,16001963965146608376,17466102332235184443,262144 /prefetch:8Jump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5356 --field-trial-handle=2008,i,16001963965146608376,17466102332235184443,262144 /prefetch:8Jump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 --field-trial-handle=2008,i,16001963965146608376,17466102332235184443,262144 /prefetch:8Jump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
    Source: C:\Users\user\Desktop\file.exeSection loaded: wsock32.dllJump to behavior
    Source: C:\Users\user\Desktop\file.exeSection loaded: version.dllJump to behavior
    Source: C:\Users\user\Desktop\file.exeSection loaded: winmm.dllJump to behavior
    Source: C:\Users\user\Desktop\file.exeSection loaded: mpr.dllJump to behavior
    Source: C:\Users\user\Desktop\file.exeSection loaded: wininet.dllJump to behavior
    Source: C:\Users\user\Desktop\file.exeSection loaded: iphlpapi.dllJump to behavior
    Source: C:\Users\user\Desktop\file.exeSection loaded: userenv.dllJump to behavior
    Source: C:\Users\user\Desktop\file.exeSection loaded: uxtheme.dllJump to behavior
    Source: C:\Users\user\Desktop\file.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Users\user\Desktop\file.exeSection loaded: windows.storage.dllJump to behavior
    Source: C:\Users\user\Desktop\file.exeSection loaded: wldp.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: version.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: mpr.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: framedynos.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: dbghelp.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: srvcli.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: netutils.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: wbemcomn.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: winsta.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: amsi.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: userenv.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: profapi.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: version.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: mpr.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: framedynos.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: dbghelp.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: srvcli.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: netutils.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: wbemcomn.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: winsta.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: amsi.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: userenv.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: profapi.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: version.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: mpr.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: framedynos.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: dbghelp.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: srvcli.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: netutils.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: wbemcomn.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: winsta.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: amsi.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: userenv.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: profapi.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: version.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: mpr.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: framedynos.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: dbghelp.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: srvcli.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: netutils.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: wbemcomn.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: winsta.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: amsi.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: userenv.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: profapi.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: version.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: mpr.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: framedynos.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: dbghelp.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: srvcli.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: netutils.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: wbemcomn.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: winsta.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: amsi.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: userenv.dllJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: profapi.dllJump to behavior
    Source: Window RecorderWindow detected: More than 3 window changes detected
    Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
    Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
    Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
    Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
    Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
    Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
    Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
    Source: file.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
    Source: file.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
    Source: file.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
    Source: file.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
    Source: file.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00A842DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_00A842DE
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AA0A76 push ecx; ret 0_2_00AA0A89
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00A9F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_00A9F98E
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00B11C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,0_2_00B11C41
    Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

    Malware Analysis System Evasion

    barindex
    Found API chain indicative of sandbox detection
    Source: C:\Users\user\Desktop\file.exeSandbox detection routine: GetForegroundWindow, DecisionNode, Sleepgraph_0-96015
    Source: C:\Users\user\Desktop\file.exeWindow / User API: threadDelayed 7291Jump to behavior
    Source: C:\Users\user\Desktop\file.exeWindow / User API: foregroundWindowGot 1774Jump to behavior
    Source: C:\Users\user\Desktop\file.exeAPI coverage: 3.6 %
    Source: C:\Users\user\Desktop\file.exe TID: 2492Thread sleep time: -72910s >= -30000sJump to behavior
    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
    Source: C:\Users\user\Desktop\file.exeThread sleep count: Count: 7291 delay: -10Jump to behavior
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AEDBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,0_2_00AEDBBE
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AF68EE FindFirstFileW,FindClose,0_2_00AF68EE
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AF698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,0_2_00AF698F
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AED076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_00AED076
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AED3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_00AED3A9
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AF9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00AF9642
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AF979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00AF979D
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AF9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00AF9B2B
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AF5C97 FindFirstFileW,FindNextFileW,FindClose,0_2_00AF5C97
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00A842DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_00A842DE
    Source: C:\Users\user\Desktop\file.exeProcess information queried: ProcessInformationJump to behavior
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AFEAA2 BlockInput,0_2_00AFEAA2
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AB2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00AB2622
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00A842DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_00A842DE
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AA4CE8 mov eax, dword ptr fs:[00000030h]0_2_00AA4CE8
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AE0B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,0_2_00AE0B62
    Source: C:\Windows\SysWOW64\taskkill.exeProcess token adjusted: DebugJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeProcess token adjusted: DebugJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeProcess token adjusted: DebugJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeProcess token adjusted: DebugJump to behavior
    Source: C:\Windows\SysWOW64\taskkill.exeProcess token adjusted: DebugJump to behavior
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AB2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00AB2622
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AA083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00AA083F
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AA09D5 SetUnhandledExceptionFilter,0_2_00AA09D5
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AA0C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00AA0C21
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AE1201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,0_2_00AE1201
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AC2BA5 KiUserCallbackDispatcher,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,0_2_00AC2BA5
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AEB226 SendInput,keybd_event,0_2_00AEB226
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00B022DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,0_2_00B022DA
    Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /TJump to behavior
    Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /TJump to behavior
    Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /TJump to behavior
    Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /TJump to behavior
    Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /TJump to behavior
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AE0B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,0_2_00AE0B62
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AE1663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,0_2_00AE1663
    Source: file.exeBinary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
    Source: file.exeBinary or memory string: Shell_TrayWnd
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AA0698 cpuid 0_2_00AA0698
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00AF8195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,0_2_00AF8195
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00ADD27A GetUserNameW,0_2_00ADD27A
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00ABBB6F _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,0_2_00ABBB6F
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00A842DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_00A842DE

    Stealing of Sensitive Information

    barindex
    Yara detected Credential Flusher
    Source: Yara matchFile source: Process Memory Space: file.exe PID: 4192, type: MEMORYSTR
    Source: file.exeBinary or memory string: WIN_81
    Source: file.exeBinary or memory string: WIN_XP
    Source: file.exeBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
    Source: file.exeBinary or memory string: WIN_XPe
    Source: file.exeBinary or memory string: WIN_VISTA
    Source: file.exeBinary or memory string: WIN_7
    Source: file.exeBinary or memory string: WIN_8

    Remote Access Functionality

    barindex
    Yara detected Credential Flusher
    Source: Yara matchFile source: Process Memory Space: file.exe PID: 4192, type: MEMORYSTR
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00B01204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,0_2_00B01204
    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00B01806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,0_2_00B01806

    Mitre Att&ck Matrix

    ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
    Gather Victim Identity InformationAcquire Infrastructure2
    Valid Accounts    		1
    Windows Management Instrumentation    		1
    DLL Side-Loading    		1
    Exploitation for Privilege Escalation    		2
    Disable or Modify Tools    		21
    Input Capture    		2
    System Time Discovery    		Remote Services1
    Archive Collected Data    		2
    Ingress Tool Transfer    		Exfiltration Over Other Network Medium1
    System Shutdown/Reboot
    CredentialsDomainsDefault Accounts1
    Native API    		2
    Valid Accounts    		1
    DLL Side-Loading    		1
    Deobfuscate/Decode Files or Information    		LSASS Memory1
    Account Discovery    		Remote Desktop Protocol21
    Input Capture    		11
    Encrypted Channel    		Exfiltration Over BluetoothNetwork Denial of Service
    Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)2
    Valid Accounts    		2
    Obfuscated Files or Information    		Security Account Manager1
    File and Directory Discovery    		SMB/Windows Admin Shares3
    Clipboard Data    		3
    Non-Application Layer Protocol    		Automated ExfiltrationData Encrypted for Impact
    Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook21
    Access Token Manipulation    		1
    DLL Side-Loading    		NTDS16
    System Information Discovery    		Distributed Component Object ModelInput Capture4
    Application Layer Protocol    		Traffic DuplicationData Destruction
    Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script2
    Process Injection    		2
    Valid Accounts    		LSA Secrets12
    Security Software Discovery    		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
    Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts12
    Virtualization/Sandbox Evasion    		Cached Domain Credentials12
    Virtualization/Sandbox Evasion    		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
    DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items21
    Access Token Manipulation    		DCSync3
    Process Discovery    		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
    Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job2
    Process Injection    		Proc Filesystem11
    Application Window Discovery    		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
    Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAtHTML Smuggling/etc/passwd and /etc/shadow1
    System Owner/User Discovery    		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Is Windows Process
    • Number of created Registry Values
    • Number of created Files
    • Visual Basic
    • Delphi
    • Java
    • .Net C# or VB.NET
    • C, C++ or other language
    • Is malicious
    • Internet
    behaviorgraph top1 signatures2 2 Behavior Graph ID: 1528363 Sample: file.exe Startdate: 07/10/2024 Architecture: WINDOWS Score: 64 46 Yara detected Credential Flusher 2->46 48 Binary is likely a compiled AutoIt script file 2->48 50 Machine Learning detection for sample 2->50 52 AI detected suspicious sample 2->52 7 file.exe 2->7         started        process3 signatures4 54 Binary is likely a compiled AutoIt script file 7->54 56 Found API chain indicative of sandbox detection 7->56 10 chrome.exe 1 7->10         started        13 taskkill.exe 1 7->13         started        15 taskkill.exe 1 7->15         started        17 3 other processes 7->17 process5 dnsIp6 42 192.168.2.4, 138, 443, 49363 unknown unknown 10->42 44 239.255.255.250 unknown Reserved 10->44 19 chrome.exe 10->19         started        22 chrome.exe 10->22         started        24 chrome.exe 6 10->24         started        26 conhost.exe 13->26         started        28 conhost.exe 15->28         started        30 conhost.exe 17->30         started        32 conhost.exe 17->32         started        34 conhost.exe 17->34         started        process7 dnsIp8 36 www.google.com 142.250.185.132, 443, 49741, 60235 GOOGLEUS United States 19->36 38 www3.l.google.com 142.250.185.174, 443, 49736, 49756 GOOGLEUS United States 19->38 40 6 other IPs or domains 19->40

    Screenshots

    Thumbnails

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


    windows-stand

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    file.exe100%Joe Sandbox ML

    Dropped Files

    ⊘No Antivirus matches

    Unpacked PE Files

    ⊘No Antivirus matches

    Domains

    ⊘No Antivirus matches

    URLs

    SourceDetectionScannerLabelLink
    https://play.google/intl/0%URL Reputationsafe
    https://families.google.com/intl/0%URL Reputationsafe
    https://policies.google.com/technologies/location-data0%URL Reputationsafe
    https://apis.google.com/js/api.js0%URL Reputationsafe
    https://policies.google.com/privacy/google-partners0%URL Reputationsafe
    https://policies.google.com/terms/service-specific0%URL Reputationsafe
    https://g.co/recover0%URL Reputationsafe
    https://policies.google.com/privacy/additional0%URL Reputationsafe
    https://support.google.com/websearch/answer/4358949?hl=ko&ref_topic=32850720%URL Reputationsafe
    https://policies.google.com/technologies/cookies0%URL Reputationsafe
    https://policies.google.com/terms0%URL Reputationsafe
    https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=0%URL Reputationsafe
    https://support.google.com/accounts?hl=0%URL Reputationsafe
    https://policies.google.com/terms/location0%URL Reputationsafe
    https://policies.google.com/privacy0%URL Reputationsafe
    https://support.google.com/accounts?p=new-si-ui0%URL Reputationsafe
    https://apis.google.com/js/rpc:shindig_random.js?onload=credentialservice.postMessage0%URL Reputationsafe

    Domains and IPs

    Contacted Domains

    NameIPActiveMaliciousAntivirus DetectionReputation
    youtube-ui.l.google.com
    		142.250.185.174
    		truefalse
      		unknown
      www3.l.google.com
      		142.250.185.174
      		truefalse
        		unknown
        play.google.com
        		142.250.185.238
        		truefalse
          		unknown
          www.google.com
          		142.250.185.132
          		truefalse
            		unknown
            youtube.com
            		142.250.184.238
            		truefalse
              		unknown
              accounts.youtube.com
              		unknown
              		unknownfalse
                		unknown
                www.youtube.com
                		unknown
                		unknownfalse
                  		unknown

                  Contacted URLs

                  NameMaliciousAntivirus DetectionReputation
                  https://play.google.com/log?format=json&hasfast=true&authuser=0false
                    		unknown
                    https://www.google.com/favicon.icofalse
                      		unknown
                      https://play.google.com/log?hasfast=true&authuser=0&format=jsonfalse
                        		unknown

                        URLs from Memory and Binaries

                        NameSourceMaliciousAntivirus DetectionReputation
                        https://play.google/intl/chromecache_137.13.drfalse
                        • URL Reputation: safe
                        		unknown
                        https://families.google.com/intl/chromecache_137.13.drfalse
                        • URL Reputation: safe
                        		unknown
                        https://youtube.com/t/terms?gl=chromecache_137.13.drfalse
                          		unknown
                          https://policies.google.com/technologies/location-datachromecache_137.13.drfalse
                          • URL Reputation: safe
                          		unknown
                          https://www.google.com/intl/chromecache_137.13.drfalse
                            		unknown
                            https://apis.google.com/js/api.jschromecache_149.13.drfalse
                            • URL Reputation: safe
                            		unknown
                            https://policies.google.com/privacy/google-partnerschromecache_137.13.drfalse
                            • URL Reputation: safe
                            		unknown
                            https://play.google.com/work/enroll?identifier=chromecache_137.13.drfalse
                              		unknown
                              https://policies.google.com/terms/service-specificchromecache_137.13.drfalse
                              • URL Reputation: safe
                              		unknown
                              https://g.co/recoverchromecache_137.13.drfalse
                              • URL Reputation: safe
                              		unknown
                              https://policies.google.com/privacy/additionalchromecache_137.13.drfalse
                              • URL Reputation: safe
                              		unknown
                              https://support.google.com/websearch/answer/4358949?hl=ko&ref_topic=3285072chromecache_137.13.drfalse
                              • URL Reputation: safe
                              		unknown
                              https://policies.google.com/technologies/cookieschromecache_137.13.drfalse
                              • URL Reputation: safe
                              		unknown
                              https://policies.google.com/termschromecache_137.13.drfalse
                              • URL Reputation: safe
                              		unknown
                              https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=chromecache_149.13.drfalse
                              • URL Reputation: safe
                              		unknown
                              https://www.google.comchromecache_137.13.drfalse
                                		unknown
                                https://play.google.com/log?format=json&hasfast=truechromecache_137.13.drfalse
                                  		unknown
                                  https://www.youtube.com/t/terms?chromeless=1&hl=chromecache_137.13.drfalse
                                    		unknown
                                    https://support.google.com/accounts?hl=chromecache_137.13.drfalse
                                    • URL Reputation: safe
                                    		unknown
                                    https://policies.google.com/terms/locationchromecache_137.13.drfalse
                                    • URL Reputation: safe
                                    		unknown
                                    https://policies.google.com/privacychromecache_137.13.drfalse
                                    • URL Reputation: safe
                                    		unknown
                                    https://support.google.com/accounts?p=new-si-uichromecache_137.13.drfalse
                                    • URL Reputation: safe
                                    		unknown
                                    https://apis.google.com/js/rpc:shindig_random.js?onload=credentialservice.postMessagechromecache_137.13.drfalse
                                    • URL Reputation: safe
                                    		unknown

                                    World Map of Contacted IPs

                                    • No. of IPs < 25%
                                    • 25% < No. of IPs < 50%
                                    • 50% < No. of IPs < 75%
                                    • 75% < No. of IPs

                                    Public IPs

                                    IPDomainCountryFlagASNASN NameMalicious
                                    142.250.186.78
                                    		unknownUnited States
                                    		15169GOOGLEUSfalse
                                    142.250.185.132
                                    		www.google.comUnited States
                                    		15169GOOGLEUSfalse
                                    142.250.185.238
                                    		play.google.comUnited States
                                    		15169GOOGLEUSfalse
                                    239.255.255.250
                                    		unknownReserved
                                    		unknownunknownfalse
                                    142.250.185.174
                                    		youtube-ui.l.google.comUnited States
                                    		15169GOOGLEUSfalse

                                    Private

                                    IP
                                    192.168.2.4

                                    General Information

                                    Joe Sandbox version:41.0.0 Charoite
                                    Analysis ID:1528363
                                    Start date and time:2024-10-07 20:45:05 +02:00
                                    Joe Sandbox product:CloudBasic
                                    Overall analysis duration:0h 5m 0s
                                    Hypervisor based Inspection enabled:false
                                    Report type:full
                                    Cookbook file name:default.jbs
                                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                    Number of analysed new started processes analysed:20
                                    Number of new started drivers analysed:0
                                    Number of existing processes analysed:0
                                    Number of existing drivers analysed:0
                                    Number of injected processes analysed:0
                                    Technologies:
                                    • HCA enabled
                                    • EGA enabled
                                    • AMSI enabled
                                    Analysis Mode:default
                                    Analysis stop reason:Timeout
                                    Sample name:file.exe
                                    Detection:MAL
                                    Classification:mal64.troj.evad.winEXE@51/30@12/6
                                    EGA Information:
                                    • Successful, ratio: 100%
                                    HCA Information:
                                    • Successful, ratio: 95%
                                    • Number of executed functions: 39
                                    • Number of non-executed functions: 310
                                    Cookbook Comments:
                                    • Found application associated with file extension: .exe

                                    Warnings

                                    • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
                                    • Excluded IPs from analysis (whitelisted): 216.58.206.67, 142.250.184.238, 64.233.167.84, 34.104.35.123, 184.28.90.27, 142.250.185.227, 142.250.184.227, 216.58.206.42, 142.250.186.74, 142.250.185.138, 216.58.206.74, 142.250.185.74, 142.250.185.202, 142.250.184.202, 142.250.181.234, 172.217.16.138, 142.250.185.234, 172.217.18.10, 142.250.186.42, 142.250.185.170, 142.250.184.234, 142.250.185.106, 216.58.212.170, 172.217.16.202, 142.250.186.170, 142.250.186.106, 2.16.100.168, 192.229.221.95, 142.250.186.163, 66.102.1.84, 216.58.206.46
                                    • Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, otelrules.azureedge.net, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, e16604.g.akamaiedge.net, update.googleapis.com, clients.l.google.com, www.gstatic.com, prod.fs.microsoft.com.akadns.net, optimizationguide-pa.googleapis.com
                                    • HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
                                    • Not all processes where analyzed, report is missing behavior information
                                    • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                    • VT rate limit hit for: file.exe

                                    Simulations

                                    Behavior and APIs

                                    ⊘No simulations

                                    Joe Sandbox View / Context

                                    IPs

                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                    239.255.255.250https://entertaininmotionre.pro/IQCm/Get hashmaliciousHTMLPhisherBrowse
                                      https://dsdhie.org/dsjhemGet hashmaliciousUnknownBrowse
                                        https://ipp.safetyworksolutions.com/Get hashmaliciousUnknownBrowse
                                          file.exeGet hashmaliciousCredential FlusherBrowse
                                            https://dsdhie.org/dsjhemGet hashmaliciousUnknownBrowse
                                              https://cloudshare.weil.com/invitations?share=f213408950da5c01bcf2Get hashmaliciousUnknownBrowse
                                                https://dsdhie.org/dsjhemGet hashmaliciousUnknownBrowse
                                                  https://66e41162be8b44fa4ef98165--lively-meringue-d6fcef.netlify.app/Get hashmaliciousUnknownBrowse
                                                    http://kendellseafoods.com/Get hashmaliciousUnknownBrowse
                                                      http://dmed-industries.comGet hashmaliciousHtmlDropperBrowse

                                                        Domains

                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext

                                                        ASNs

                                                        ⊘No context

                                                        JA3 Fingerprints

                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                        28a2c9bd18a11de089ef85a160da29e4https://entertaininmotionre.pro/IQCm/Get hashmaliciousHTMLPhisherBrowse
                                                        • 4.175.87.197
                                                        • 13.107.246.60
                                                        https://dsdhie.org/dsjhemGet hashmaliciousUnknownBrowse
                                                        • 4.175.87.197
                                                        • 13.107.246.60
                                                        https://ipp.safetyworksolutions.com/Get hashmaliciousUnknownBrowse
                                                        • 4.175.87.197
                                                        • 13.107.246.60
                                                        wULBz8VjH0.exeGet hashmaliciousVidarBrowse
                                                        • 4.175.87.197
                                                        • 13.107.246.60
                                                        file.exeGet hashmaliciousCredential FlusherBrowse
                                                        • 4.175.87.197
                                                        • 13.107.246.60
                                                        FdjDPFGTZS.exeGet hashmaliciousLummaC, Stealc, VidarBrowse
                                                        • 4.175.87.197
                                                        • 13.107.246.60
                                                        2005.exeGet hashmaliciousDiceBrowse
                                                        • 4.175.87.197
                                                        • 13.107.246.60
                                                        https://dsdhie.org/dsjhemGet hashmaliciousUnknownBrowse
                                                        • 4.175.87.197
                                                        • 13.107.246.60
                                                        2005.exeGet hashmaliciousUnknownBrowse
                                                        • 4.175.87.197
                                                        • 13.107.246.60
                                                        https://cloudshare.weil.com/invitations?share=f213408950da5c01bcf2Get hashmaliciousUnknownBrowse
                                                        • 4.175.87.197
                                                        • 13.107.246.60

                                                        Dropped Files

                                                        ⊘No context

                                                        Created / dropped Files

                                                        Chrome Cache Entry: 136

                                                        Download File
                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        File Type:ASCII text, with very long lines (522)
                                                        Category:downloaded
                                                        Size (bytes):5050
                                                        Entropy (8bit):5.30005628600801
                                                        Encrypted:false
                                                        SSDEEP:96:o75BuBxJfma7bGZABddEgf8nI4zLm4KGo8Vh1EabPVTq8fv/xRw:WHMmaX9r8Igp7nBlHo
                                                        MD5:D9F15F1AEAF15673336FAA3507D1A2A7
                                                        SHA1:FC79D00AF2E2D44FEBA701F12ECD4AFCA327F464
                                                        SHA-256:AA3574ADCF3826390918BC2D5DCD88D7BC63238A6022DEF3487A67A731C30E7A
                                                        SHA-512:D756961B6BFC478274E390B94D613BD837DA011D680FC6D67779A8E12C7F082EF977FC15D02C076F92BC1D2CE7EFDE48F82B4EC1BD12CF38AEDDAB1917E36041
                                                        Malicious:false
                                                        URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PqO-Y4U4tl0.es5.O/ck=boq-identity.AccountsSignInUi.nq70RHujW6U.L.B1.O/am=xMFgKBi2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,iAskyc,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGiXTMuN04FgQ4LzahFtNqboYL9eA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=wg1P6b"
                                                        Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.oNa=_.z("wg1P6b",[_.XA,_.Fn,_.Nn]);._.k("wg1P6b");.var f6a;f6a=_.mh(["aria-"]);._.yJ=function(a){_.X.call(this,a.Fa);this.Ka=this.xa=this.aa=this.viewportElement=this.Na=null;this.Jc=a.Ea.ef;this.ab=a.Ea.focus;this.Fc=a.Ea.Fc;this.ea=this.Qi();a=-1*parseInt(_.Fo(this.Qi().el(),"marginTop")||"0",10);var b=parseInt(_.Fo(this.Qi().el(),"marginBottom")||"0",10);this.Ta={top:a,right:0,bottom:b,left:0};a=_.cf(this.getData("isMenuDynamic"),!1);b=_.cf(this.getData("isMenuHoisted"),!1);this.Ga=a?1:b?2:0;this.ka=!1;this.Ca=1;this.Ga!==1&&(this.aa=this.Sa("U0exHf").children().Wc(0),_.ku(this,.g6a(this,this.aa.el())));_.oF(this.oa())&&(a=this.oa().el(),b=this.we.bind(this),a.__soy_skip_handler=b)};_.J(_.yJ,_.X);_.yJ.Ba=function(){return{Ea:{ef:_.cF,focus:_.OE,Fc:_.uu}}};_.yJ.prototype.IF=function(a){var b=a.source;this.Na=b;var c;((c=a.data)==null?0:c.qz)?(a=a.data.qz,this.Ca=a==="MOUS

                                                        Chrome Cache Entry: 137

                                                        Download File
                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        File Type:ASCII text, with very long lines (5693)
                                                        Category:downloaded
                                                        Size (bytes):698852
                                                        Entropy (8bit):5.594980353163612
                                                        Encrypted:false
                                                        SSDEEP:6144:TN3KfgnkxgOYoRvEoQvSXwojVlmGa/ZLJiH7ZkvgTa5PB1+UO5Hx+B8U2+:TUMkxgOENagFxJiyU+
                                                        MD5:AA9FDCBE29C6D043DC83A7DAD848CCC3
                                                        SHA1:E3F0A387A0A4B060620C975E1C70AA20294F3F22
                                                        SHA-256:1A624C24D6D712C633F0B034606610DAD6B5AD7890FBFA3A9B204BD33207D60E
                                                        SHA-512:C93878CE1281349204ABDB4444B18A12C03A010D1A252827EBFE45523E834988CE95D6E625FF82A60934D7A275AD8DAAC689E4412C5719ACCA8C9E1D4365B4D3
                                                        Malicious:false
                                                        URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PqO-Y4U4tl0.es5.O/ck=boq-identity.AccountsSignInUi.nq70RHujW6U.L.B1.O/am=xMFgKBi2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGiXTMuN04FgQ4LzahFtNqboYL9eA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=n73qwf,SCuOPb,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,XVq9Qb,STuCOe,njlZCf,m9oV,vjKJJ,y5vRwf,iyZMqd,NTMZac,mzzZzc,rCcCxc,vvMGie,K1ZKnb,ziZ8Mc,b3kMqb,mvkUhe,CMcBD,Fndnac,t2srLd,EN3i8d,z0u0L,xiZRqc,NOeYWe,O6y8ed,L9OGUe,PrPYRd,MpJwZc,qPfo0c,cYShmd,hc6Ubd,Rkm0ef,KUM7Z,oLggrd,inNHtf,L1AAkb,WpP9Yc,lwddkf,gJzDyc,SpsfSb,aC1iue,tUnxGc,aW3pY,ZakeSe,EFQ78c,xQtZb,I6YDgd,zbML3c,zr1jrb,vHEMJe,YHI3We,YTxL4,bSspM,Uas9Hd,zy0vNb,K0PMbc,AvtSve,qmdT9,MY7mZe,xBaz7b,GwYlN,eVCnO,EIOG1e,LDQI"
                                                        Preview:"use strict";_F_installCss(".r4WGQb{position:relative}.Dl08I>:first-child{margin-top:0}.Dl08I>:last-child{margin-bottom:0}.IzwVE{color:#1f1f1f;color:var(--gm3-sys-color-on-surface,#1f1f1f);font-family:\"Google Sans\",roboto,\"Noto Sans Myanmar UI\",arial,sans-serif;font-size:1.25rem;font-weight:400;letter-spacing:0rem;line-height:1.2}.l5PPKe{color:#1f1f1f;color:var(--gm3-sys-color-on-surface,#1f1f1f);font-size:1rem}.l5PPKe .dMNVAe{margin:0;padding:0}.l5PPKe>:first-child{margin-top:0;padding-top:0}.l5PPKe>:last-child{margin-bottom:0;padding-bottom:0}.Dl08I{margin:0;padding:0;position:relative}.Dl08I>.SmR8:only-child{padding-top:1px}.Dl08I>.SmR8:only-child::before{top:0}.Dl08I>.SmR8:not(first-child){padding-bottom:1px}.Dl08I>.SmR8::after{bottom:0}.Dl08I>.SmR8:only-child::before,.Dl08I>.SmR8::after{border-bottom:1px solid #c4c7c5;border-bottom:1px solid var(--gm3-sys-color-outline-variant,#c4c7c5);content:\"\";height:0;left:0;position:absolute;width:100%}.aZvCDf{margin-top:8px;margin-left

                                                        Chrome Cache Entry: 138

                                                        Download File
                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        File Type:ASCII text, with very long lines (570)
                                                        Category:downloaded
                                                        Size (bytes):3467
                                                        Entropy (8bit):5.508385764606741
                                                        Encrypted:false
                                                        SSDEEP:96:ogbsxK3SrI2Jrutmxy9FALtcP+EGYkxhclzV9xCw:Psc3OIpDj2ZYkxhATxX
                                                        MD5:231ABD6E6C360E709640B399EDF85476
                                                        SHA1:6CB98F38D9B6FDCF2E7D7C7682A219082F2E1E75
                                                        SHA-256:44B5D535663C65CD2E6228EF1F0C3DBA9C89EAE5C1BF079A6C4C64972DEE989D
                                                        SHA-512:D45455810B34493A05BA2DD7ADF24C0C009F4CF0898AE9C57978D38C8F2654CEEFC11D1C151BA72B902E0FA87537D43C37957DCAEC1792B5277B54C8E7BCCA3C
                                                        Malicious:false
                                                        URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PqO-Y4U4tl0.es5.O/ck=boq-identity.AccountsSignInUi.nq70RHujW6U.L.B1.O/am=xMFgKBi2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,iAskyc,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,wg1P6b,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGiXTMuN04FgQ4LzahFtNqboYL9eA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=Wt6vjf,hhhU8,FCpbqb,WhJNk"
                                                        Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("Wt6vjf");.var fya=function(){var a=_.He();return _.Nj(a,1)},au=function(a){this.Da=_.t(a,0,au.messageId)};_.J(au,_.v);au.prototype.Ha=function(){return _.Fj(this,1)};au.prototype.Ua=function(a){return _.Xj(this,1,a)};au.messageId="f.bo";var bu=function(){_.km.call(this)};_.J(bu,_.km);bu.prototype.xd=function(){this.NT=!1;gya(this);_.km.prototype.xd.call(this)};bu.prototype.aa=function(){hya(this);if(this.JC)return iya(this),!1;if(!this.UV)return cu(this),!0;this.dispatchEvent("p");if(!this.HP)return cu(this),!0;this.NM?(this.dispatchEvent("r"),cu(this)):iya(this);return!1};.var jya=function(a){var b=new _.gp(a.b5);a.vQ!=null&&_.Mn(b,"authuser",a.vQ);return b},iya=function(a){a.JC=!0;var b=jya(a),c="rt=r&f_uid="+_.rk(a.HP);_.fn(b,(0,_.bg)(a.ea,a),"POST",c)};.bu.prototype.ea=function(a){a=a.target;hya(this);if(_.jn(a)){this.iK=0;if(this.NM)this.JC=!1,this.dispatchEvent("r"

                                                        Chrome Cache Entry: 139

                                                        Download File
                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        File Type:ASCII text, with very long lines (533)
                                                        Category:downloaded
                                                        Size (bytes):9210
                                                        Entropy (8bit):5.393248075042016
                                                        Encrypted:false
                                                        SSDEEP:192:t7mFYxV97I4Ia0U44rS3mt8IV7ydti6M5/1JlNg:t7vB7Il2t+dEF1JlNg
                                                        MD5:2ED5BC88509286438B682EFF23518005
                                                        SHA1:D5C8FD77BA3ED7F977A4AD0C85CF026D0F74F3E2
                                                        SHA-256:F878D44B5CAC6BC95D638C13D0814C10E7D6CC145351ABA7945F53D8CB167979
                                                        SHA-512:12F5415A482286C53631D09B5F50BA4AAA0957DB61904430E5B728777A15DC62428ED560847AB1DFEC459E302FB4D009D32CC1770EAD5425023CA48DF4640AA4
                                                        Malicious:false
                                                        URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PqO-Y4U4tl0.es5.O/ck=boq-identity.AccountsSignInUi.nq70RHujW6U.L.B1.O/am=xMFgKBi2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PrPYRd,Rkm0ef,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,byfTOb,cYShmd,eVCnO,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,qPfo0c,qmdT9,rCcCxc,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGiXTMuN04FgQ4LzahFtNqboYL9eA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ltDFwf,SD8Jgb,rmumx,E87wgc,qPYxq,Tbb4sb,pxq3x,f8Gu1e,soHxf,YgOFye,yRXbo,bTi8wc,ywOR5c,PHUIyb"
                                                        Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.vNa=_.z("SD8Jgb",[]);._.GX=function(a,b){if(typeof b==="string")a.Nc(b);else if(b instanceof _.Ip&&b.ia&&b.ia===_.A)b=_.Za(b.Ku()),a.empty().append(b);else if(b instanceof _.Ua)b=_.Za(b),a.empty().append(b);else if(b instanceof Node)a.empty().append(b);else throw Error("Wf");};_.HX=function(a){var b=_.Lo(a,"[jsslot]");if(b.size()>0)return b;b=new _.Jo([_.Qk("span")]);_.Mo(b,"jsslot","");a.empty().append(b);return b};_.bMb=function(a){return a===null||typeof a==="string"&&_.Ji(a)};._.k("SD8Jgb");._.MX=function(a){_.X.call(this,a.Fa);this.Va=a.controller.Va;this.od=a.controllers.od[0]||null;this.header=a.controller.header;this.nav=a.controller.nav;var b;(b=this.oa().find("button:not([type])").el())==null||b.setAttribute("type","button")};_.J(_.MX,_.X);_.MX.Ba=function(){return{controller:{Va:{jsname:"n7vHCb",ctor:_.pv},header:{jsname:"tJHJj",ctor:_.pv},nav:{jsname:"DH6Rkf",ct

                                                        Chrome Cache Entry: 140

                                                        Download File
                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        File Type:ASCII text, with very long lines (468)
                                                        Category:downloaded
                                                        Size (bytes):1858
                                                        Entropy (8bit):5.297658905867848
                                                        Encrypted:false
                                                        SSDEEP:48:o7vjoGL3AeFkphnpiu7cOyBfO/3d/rYrv3Zrw:ofrLxFuLdyp2AVw
                                                        MD5:B42DB3D22B12B8E3BE1B82961FE2870E
                                                        SHA1:D9CFD11C1C2DE17A7E9301F11AD875B610B96576
                                                        SHA-256:75DC40A81CEACB57940F84D2B29E021974C3004B245CC7198362CA944E9C4058
                                                        SHA-512:EC0708797586F8F85EC8A0BBECA707D73778D93C12986B92965D1828B254D39485926354AEC4D73474BC5755E392B813D8045B19369FAE23B30BBD12E17F7053
                                                        Malicious:false
                                                        URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PqO-Y4U4tl0.es5.O/ck=boq-identity.AccountsSignInUi.nq70RHujW6U.L.B1.O/am=xMFgKBi2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGiXTMuN04FgQ4LzahFtNqboYL9eA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=iAskyc,ziXSP"
                                                        Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("iAskyc");._.QZ=function(a){_.W.call(this,a.Fa);this.window=a.Ea.window.get();this.Mc=a.Ea.Mc};_.J(_.QZ,_.W);_.QZ.Ba=function(){return{Ea:{window:_.tu,Mc:_.HE}}};_.QZ.prototype.Po=function(){};_.QZ.prototype.addEncryptionRecoveryMethod=function(){};_.RZ=function(a){return(a==null?void 0:a.Jo)||function(){}};_.SZ=function(a){return(a==null?void 0:a.r3)||function(){}};_.VPb=function(a){return(a==null?void 0:a.Qp)||function(){}};._.WPb=function(a){return new Map(Array.from(a,function(b){var c=_.n(b);b=c.next().value;c=c.next().value;return[b,c.map(function(d){return{epoch:d.epoch,key:new Uint8Array(d.key)}})]}))};_.XPb=function(a){setTimeout(function(){throw a;},0)};_.QZ.prototype.qO=function(){return!0};_.qu(_.Dn,_.QZ);._.l();._.k("ziXSP");.var j_=function(a){_.QZ.call(this,a.Fa)};_.J(j_,_.QZ);j_.Ba=_.QZ.Ba;j_.prototype.Po=function(a,b,c){var d;if((d=this.window.chrome)==nu

                                                        Chrome Cache Entry: 141

                                                        Download File
                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                        Category:downloaded
                                                        Size (bytes):5430
                                                        Entropy (8bit):3.6534652184263736
                                                        Encrypted:false
                                                        SSDEEP:48:wIJct3xIAxG/7nvWDtZcdYLtX7B6QXL3aqG8Q:wIJct+A47v+rcqlBPG9B
                                                        MD5:F3418A443E7D841097C714D69EC4BCB8
                                                        SHA1:49263695F6B0CDD72F45CF1B775E660FDC36C606
                                                        SHA-256:6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770
                                                        SHA-512:82D017C4B7EC8E0C46E8B75DA0CA6A52FD8BCE7FCF4E556CBDF16B49FC81BE9953FE7E25A05F63ECD41C7272E8BB0A9FD9AEDF0AC06CB6032330B096B3702563
                                                        Malicious:false
                                                        URL:https://www.google.com/favicon.ico
                                                        Preview:............ .h...&... .... .........(....... ..... ............................................0...................................................................................................................................v.].X.:.X.:.r.Y........................................q.X.S.4.S.4.S.4.S.4.S.4.S.4...X....................0........q.W.S.4.X.:.................J...A...g.........................K.H.V.8..........................F..B.....................,.......................................B..............................................B..B..B..B..B...u..........................................B..B..B..B..B...{.................5.......k...........................................................7R..8F.................................................2........Vb..5C..;I..................R^.....................0................Xc..5C..5C..5C..5C..5C..5C..lv..........................................]i..<J..:G..Zf....................................................

                                                        Chrome Cache Entry: 142

                                                        Download File
                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        File Type:ASCII text, with very long lines (1694)
                                                        Category:downloaded
                                                        Size (bytes):32500
                                                        Entropy (8bit):5.378121087555083
                                                        Encrypted:false
                                                        SSDEEP:768:OnTTScxIXeijt4aRZf4AEqTzQh2HIVVcYTVf79pew6cVEkAXtuWsmsL:iA4w4A4h2HIVVcMVf72QA9jOL
                                                        MD5:57D7B0A2CE36496F05AFA27B39C1F219
                                                        SHA1:418AD03C2E75AEAF188E2A00123B70E09D541656
                                                        SHA-256:E247A1F5E564A248C92E39C040A06B9B3BEA50A130CC98F2787FB5E2441E0707
                                                        SHA-512:78B135A69424F951AC7E3CCBDC4F496BCA0BE6A2312DC90DFA29032C7DB19455B7E35FEE57F470729EC5E86D52DC19037BB6404C27DF614A548DE409527866C2
                                                        Malicious:false
                                                        URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PqO-Y4U4tl0.es5.O/ck=boq-identity.AccountsSignInUi.nq70RHujW6U.L.B1.O/am=xMFgKBi2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGiXTMuN04FgQ4LzahFtNqboYL9eA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe"
                                                        Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{.var Cua=function(a,b){this.da=a;this.ea=b;if(!c){var c=new _.gp("//www.google.com/images/cleardot.gif");_.rp(c)}this.ka=c};_.h=Cua.prototype;_.h.Zc=null;_.h.rZ=1E4;_.h.jA=!1;_.h.sQ=0;_.h.JJ=null;_.h.gV=null;_.h.setTimeout=function(a){this.rZ=a};_.h.start=function(){if(this.jA)throw Error("dc");this.jA=!0;this.sQ=0;Dua(this)};_.h.stop=function(){Eua(this);this.jA=!1};.var Dua=function(a){a.sQ++;navigator!==null&&"onLine"in navigator&&!navigator.onLine?_.om((0,_.bg)(a.hH,a,!1),0):(a.aa=new Image,a.aa.onload=(0,_.bg)(a.Kja,a),a.aa.onerror=(0,_.bg)(a.Jja,a),a.aa.onabort=(0,_.bg)(a.Ija,a),a.JJ=_.om(a.Lja,a.rZ,a),a.aa.src=String(a.ka))};_.h=Cua.prototype;_.h.Kja=function(){this.hH(!0)};_.h.Jja=function(){this.hH(!1)};_.h.Ija=function(){this.hH(!1)};_.h.Lja=function(){this.hH(!1)};._.h.hH=function(a){Eua(this);a?(this.jA=!1,this.da.call(this.ea,!0)):this.sQ<=0?Dua(this):(this.jA=!1,

                                                        Chrome Cache Entry: 143

                                                        Download File
                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        File Type:Web Open Font Format (Version 2), TrueType, length 52280, version 1.0
                                                        Category:downloaded
                                                        Size (bytes):52280
                                                        Entropy (8bit):7.995413196679271
                                                        Encrypted:true
                                                        SSDEEP:1536:1rvqtK8DZilXxwJ8mMwAZy7phqsFLdG3B4d:xytBZits8bw4wzbFxG3B4d
                                                        MD5:F61F0D4D0F968D5BBA39A84C76277E1A
                                                        SHA1:AA3693EA140ECA418B4B2A30F6A68F6F43B4BEB2
                                                        SHA-256:57147F08949ABABE7DEEF611435AE418475A693E3823769A25C2A39B6EAD9CCC
                                                        SHA-512:6C3BD90F709BCF9151C9ED9FFEA55C4F6883E7FDA2A4E26BF018C83FE1CFBE4F4AA0DB080D6D024070D53B2257472C399C8AC44EEFD38B9445640EFA85D5C487
                                                        Malicious:false
                                                        URL:https://fonts.gstatic.com/s/googlesans/v58/4UaRrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iq2vgCI.woff2
                                                        Preview:wOF2.......8.....................................^...$..4?HVAR..?MVAR9.`?STAT.*',..J/.......`..(..Z.0..R.6.$.... .....K..[..q..c..T.....>.P.j.`.w..#...%......N.".....$..3.0.6......... .L.rX/r[j.y.|*(.4.%#.....2.v.m..-..%.....;-.Y.{..&..O=#l@...k..7g..ZI...#.Z./+T..r7...M..3).Z%.x....s..sL..[A!.5*1w'/.8V..2Z..%.X.h.o.).]..9..Q`.$.....7..kZ.~O........d..g.n.d.Rw+&....Cz..uy#..fz,(.J....v.%..`..9.....h...?O..:...c%.....6s....xl..#...5..._......1.>.)"U.4 W....?%......6//!$...!.n9C@n...........!""^.....W..Z<.7.x.."UT.T....E.."R>.R..t.....H d..e_.K../.+8.Q.P.ZQ....;...U....]......._.e*......71.?.7.ORv.?...l...G|.P...|:...I.X..2.,.L........d.g.]}W#uW]QnuP-s.;.-Y.....].......C..j_.M0...y.......J..........NY..@A...,....-.F......'..w./j5g.vUS...U..0.&...y7.LP.....%.....Y......Y..D. e.A..G.?.$.......6...eaK.n5.m...N...,...+BCl..L> .E9~.b[.w.x....6<...}.e...%V....O.......*.?...a..#[eE.4..p..$...].....%......o._......N.._~..El....b..A.0.r8.....|..D.d..

                                                        Chrome Cache Entry: 144

                                                        Download File
                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        File Type:ASCII text, with very long lines (755)
                                                        Category:downloaded
                                                        Size (bytes):1460
                                                        Entropy (8bit):5.274624539239422
                                                        Encrypted:false
                                                        SSDEEP:24:kMYD7DUuXIqMSsN7UYgtx/mQ7hz1BU6TZ6BdXDMvUKGbWxlGb+jSFFV87Ofk8tp8:o7DhXI6PoXwsKGb2lGb+jS9Mwrw
                                                        MD5:481C149C4D3EE4A53C3E7CBA067371DF
                                                        SHA1:E0FED275636D3492C922C44F010157FAF0936733
                                                        SHA-256:9327A53F577C5FCEFDB162E02D8646CE5B70DF2201F4B3289384657B32BACE70
                                                        SHA-512:EC5C5A03ED4E1A27BEE7E1C488A238D79A9787D944E364CCE516FB28C22256919E49C99BFCFEA0F7815AB4232A350914E26D33D20F5A81ED19A39DFD40E30C79
                                                        Malicious:false
                                                        URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PqO-Y4U4tl0.es5.O/ck=boq-identity.AccountsSignInUi.nq70RHujW6U.L.B1.O/am=xMFgKBi2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGiXTMuN04FgQ4LzahFtNqboYL9eA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=P6sQOc"
                                                        Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("lOO0Vd");._.b_a=new _.pf(_.Dm);._.l();._.k("P6sQOc");.var g_a=!!(_.Mh[1]&16);var i_a=function(a,b,c,d,e){this.ea=a;this.xa=b;this.ka=c;this.Ca=d;this.Ga=e;this.aa=0;this.da=h_a(this)},j_a=function(a){var b={};_.Ma(a.HS(),function(e){b[e]=!0});var c=a.uS(),d=a.yS();return new i_a(a.wP(),c.aa()*1E3,a.bS(),d.aa()*1E3,b)},h_a=function(a){return Math.random()*Math.min(a.xa*Math.pow(a.ka,a.aa),a.Ca)},SG=function(a,b){return a.aa>=a.ea?!1:b!=null?!!a.Ga[b]:!0};var TG=function(a){_.W.call(this,a.Fa);this.da=a.Ea.JV;this.ea=a.Ea.metadata;a=a.Ea.cha;this.fetch=a.fetch.bind(a)};_.J(TG,_.W);TG.Ba=function(){return{Ea:{JV:_.e_a,metadata:_.b_a,cha:_.VZa}}};TG.prototype.aa=function(a,b){if(this.ea.getType(a.Od())!==1)return _.Vm(a);var c=this.da.jV;return(c=c?j_a(c):null)&&SG(c)?_.zya(a,k_a(this,a,b,c)):_.Vm(a)};.var k_a=function(a,b,c,d){return c.then(function(e){return e},function(e)

                                                        Chrome Cache Entry: 145

                                                        Download File
                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        File Type:ASCII text, with very long lines (2907)
                                                        Category:downloaded
                                                        Size (bytes):23298
                                                        Entropy (8bit):5.429186219736739
                                                        Encrypted:false
                                                        SSDEEP:384:+BitNeB9HVPQmqySWyvbbb/XEm6k1JTM2qzhOF0bCjOgiQBH2f+wl9nyf0zHwx:+BiHeB9Hecebbb/PONOFnjOgPBHgSywx
                                                        MD5:A5C41D7BA22E9CF451810802AE5AC2E8
                                                        SHA1:858F35134A0BD7BAECB1B1A30EC3645642214554
                                                        SHA-256:D29364A1E9EDE91152F2CB84962B73644741817C9C6A615C1FB70A885DD1CB8D
                                                        SHA-512:DEA28AD362B51832D33CD9E936C0A255FA32C20DFFC6E806DA7AAF657D3490AF079C40FE21E10B2FDC971EB066E51ABDA182DEDC156759CCE06440E456FEB316
                                                        Malicious:false
                                                        URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PqO-Y4U4tl0.es5.O/ck=boq-identity.AccountsSignInUi.nq70RHujW6U.L.B1.O/am=xMFgKBi2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGiXTMuN04FgQ4LzahFtNqboYL9eA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=RqjULd"
                                                        Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.xu.prototype.da=_.ca(40,function(){return _.tj(this,3)});_.cz=function(a,b){this.key=a;this.defaultValue=!1;this.flagName=b};_.cz.prototype.ctor=function(a){return typeof a==="boolean"?a:this.defaultValue};_.dz=function(){this.ka=!0;var a=_.xj(_.fk(_.Be("TSDtV",window),_.Cya),_.xu,1,_.sj())[0];if(a){var b={};for(var c=_.n(_.xj(a,_.Dya,2,_.sj())),d=c.next();!d.done;d=c.next()){d=d.value;var e=_.Lj(d,1).toString();switch(_.vj(d,_.yu)){case 3:b[e]=_.Jj(d,_.nj(d,_.yu,3));break;case 2:b[e]=_.Lj(d,_.nj(d,_.yu,2));break;case 4:b[e]=_.Mj(d,_.nj(d,_.yu,4));break;case 5:b[e]=_.Nj(d,_.nj(d,_.yu,5));break;case 6:b[e]=_.Rj(d,_.ff,6,_.yu);break;default:throw Error("jd`"+_.vj(d,_.yu));}}}else b={};this.ea=b;this.token=.a?a.da():null};_.dz.prototype.aa=function(a){if(!this.ka||a.key in this.ea)a=a.ctor(this.ea[a.key]);else if(_.Be("nQyAE",window)){var b=_.Fya(a.flagName);if(b===null)a=a.de

                                                        Chrome Cache Entry: 146

                                                        Download File
                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        File Type:ASCII text, with very long lines (683)
                                                        Category:downloaded
                                                        Size (bytes):3131
                                                        Entropy (8bit):5.352056237104327
                                                        Encrypted:false
                                                        SSDEEP:48:o7hHD75byh9xqKP5jNQ8js63rAwrMNhYfmdpwoKLEy5aQW5Tx5v3MmFopMGIWO4x:oFD+95jOQr3AT7wRLDGD5flBb4Ew
                                                        MD5:ADEF03127F74F5E6742B8CFA7B863F28
                                                        SHA1:58D7C635582AF10E91EC047FD315FAF758AF51DA
                                                        SHA-256:5FDD639E222F58AEB6178EB02583086BCC50ED219DEAA953D0E7984DD0E1FEDC
                                                        SHA-512:3AC26E9569EE83298F386D551774F378D3E433A2C80C1D4BC7481C544605A2FA4943F6CBC8E97FBF8FE3C32C1EFB2A1CCAA01403819482FC7429538FDF2CA758
                                                        Malicious:false
                                                        URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PqO-Y4U4tl0.es5.O/ck=boq-identity.AccountsSignInUi.nq70RHujW6U.L.B1.O/am=xMFgKBi2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGiXTMuN04FgQ4LzahFtNqboYL9eA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ZwDk9d,RMhBfe"
                                                        Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("ZwDk9d");.var kA=function(a){_.W.call(this,a.Fa)};_.J(kA,_.W);kA.Ba=_.W.Ba;kA.prototype.jS=function(a){return _.Ye(this,{Xa:{lT:_.ol}}).then(function(b){var c=window._wjdd,d=window._wjdc;return!c&&d?new _.ni(function(e){window._wjdc=function(f){d(f);e(dKa(f,b,a))}}):dKa(c,b,a)})};var dKa=function(a,b,c){return(a=a&&a[c])?a:b.Xa.lT.jS(c)};.kA.prototype.aa=function(a,b){var c=_.Dra(b).Tj;if(c.startsWith("$")){var d=_.jm.get(a);_.xq[b]&&(d||(d={},_.jm.set(a,d)),d[c]=_.xq[b],delete _.xq[b],_.yq--);if(d)if(a=d[c])b=_.af(a);else throw Error("Jb`"+b);else b=null}else b=null;return b};_.qu(_.Lfa,kA);._.l();._.k("SNUn3");._.cKa=new _.pf(_.wg);._.l();._.k("RMhBfe");.var eKa=function(a){var b=_.wq(a);return b?new _.ni(function(c,d){var e=function(){b=_.wq(a);var f=_.Sfa(a,b);f?c(f.getAttribute("jsdata")):window.document.readyState=="complete"?(f=["Unable to find deferred jsdata wit

                                                        Chrome Cache Entry: 147

                                                        Download File
                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        File Type:ASCII text, with very long lines (395)
                                                        Category:downloaded
                                                        Size (bytes):1608
                                                        Entropy (8bit):5.271783084011668
                                                        Encrypted:false
                                                        SSDEEP:48:o726BiFP89yAxKz1TtMxII+eXww7D2bc+rw:oyMyAAz1WNd8vw
                                                        MD5:45EA91A811A594F81B7F760DD14BE237
                                                        SHA1:2C97782C6D5D0BCFB3676FF24AA1008251090DAE
                                                        SHA-256:7488FF4710E7592F66BE1FAC090F73CB8F1D2D0794B57DEAC1798C5B309EE76F
                                                        SHA-512:4F79A36857D5A8AF1E2F938EF92EA75C384DE4789972B068BE82EADAA442C538A65035CCE8665A7283137E2075B8FE4C1C9E7B2A36585491683B4869005B772A
                                                        Malicious:false
                                                        URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PqO-Y4U4tl0.es5.O/ck=boq-identity.AccountsSignInUi.nq70RHujW6U.L.B1.O/am=xMFgKBi2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGiXTMuN04FgQ4LzahFtNqboYL9eA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=w9hDv,ZDZcre,A7fCU"
                                                        Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("w9hDv");._.vg(_.Ila);_.iA=function(a){_.W.call(this,a.Fa);this.aa=a.Xa.cache};_.J(_.iA,_.W);_.iA.Ba=function(){return{Xa:{cache:_.gt}}};_.iA.prototype.execute=function(a){_.Bb(a,function(b){var c;_.$e(b)&&(c=b.eb.kc(b.kb));c&&this.aa.LG(c)},this);return{}};_.qu(_.Ola,_.iA);._.l();._.k("ZDZcre");.var jH=function(a){_.W.call(this,a.Fa);this.Xl=a.Ea.Xl;this.j4=a.Ea.metadata;this.aa=a.Ea.wt};_.J(jH,_.W);jH.Ba=function(){return{Ea:{Xl:_.OG,metadata:_.b_a,wt:_.LG}}};jH.prototype.execute=function(a){var b=this;a=this.aa.create(a);return _.Bb(a,function(c){var d=b.j4.getType(c.Od())===2?b.Xl.Rb(c):b.Xl.fetch(c);return _.Bl(c,_.PG)?d.then(function(e){return _.Dd(e)}):d},this)};_.qu(_.Tla,jH);._.l();._.k("K5nYTd");._.a_a=new _.pf(_.Pla);._.l();._.k("sP4Vbe");.._.l();._.k("kMFpHd");.._.l();._.k("A7fCU");.var RG=function(a){_.W.call(this,a.Fa);this.aa=a.Ea.yQ};_.J(RG,_.W);RG.Ba=func

                                                        Chrome Cache Entry: 148

                                                        Download File
                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        File Type:ASCII text, with no line terminators
                                                        Category:downloaded
                                                        Size (bytes):84
                                                        Entropy (8bit):4.875266466142591
                                                        Encrypted:false
                                                        SSDEEP:3:DZFJu0+WVTBCq2Bjdw2KsJJuYHSKnZ:lFJuuVTBudw29nu4SKZ
                                                        MD5:87B6333E98B7620EA1FF98D1A837A39E
                                                        SHA1:105DE6815B0885357DE1414BFC0D77FCC9E924EF
                                                        SHA-256:DCD3C133C5C40BECD4100BBE6EDAE84C9735E778E4234A5E8395C56FF8A733BA
                                                        SHA-512:867D7943D813685FAA76394E53199750C55817E836FD19C933F74D11E9657CE66719A6D6B2E39EE1DE62358BCE364E38A55F4E138DF92337DE6985DDCD5D0994
                                                        Malicious:false
                                                        URL:https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISHgmA6QC9dWevzxIFDRkBE_oSBQ3oIX6GEgUN05ioBw==?alt=proto
                                                        Preview:Cj0KBw0ZARP6GgAKKQ3oIX6GGgQISxgCKhwIClIYCg5AIS4jJF8qLSY/Ky8lLBABGP////8PCgcN05ioBxoA

                                                        Chrome Cache Entry: 149

                                                        Download File
                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        File Type:ASCII text, with very long lines (553)
                                                        Category:downloaded
                                                        Size (bytes):744742
                                                        Entropy (8bit):5.792853825531523
                                                        Encrypted:false
                                                        SSDEEP:6144:x5bdWK/20rOQKKQtvqUGSGDdPSxdZqmguPH:pOeKGSpgu/
                                                        MD5:D6A4595EF381156A4C38FC1268C40783
                                                        SHA1:75B2E4139EE5014416D280B02E1F57724B0A4240
                                                        SHA-256:9E6266EF7F49A5256F373AB78F9D0AE688CA964F542892F5FF0563F05AC6C676
                                                        SHA-512:ACC3385A52ABFA53EE68286C86F2266C2BE7D12350F31AEFD91052616CF417207E5F27A31FEC5FB4B5DDA705C599DD0B724ACA88E9FF682289C3B473902CD79C
                                                        Malicious:false
                                                        URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PqO-Y4U4tl0.es5.O/am=xMFgKBi2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlEEvjRYpfMDihaNwG0swUsVgVpBIg/m=_b,_tp"
                                                        Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a||[]};(0,_._F_toggles_initialize)([0x2860c1c4, 0x2046d860, 0x39e1fc40, 0x14501e80, 0xe420, 0x0, 0x1a000000, 0x1d000003, 0xc, ]);./*.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0.*/./*.. Copyright Google LLC. SPDX-License-Identifier: Apache-2.0.*/./*.. Copyright 2024 Google, Inc. SPDX-License-Identifier: MIT.*/./*. SPDX-License-Identifier: Apache-2.0.*/./*. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0.*/.var baa,daa,Na,Ta,gaa,iaa,jb,qaa,waa,Caa,Haa,Kaa,Jb,Laa,Ob,Qb,Rb,Maa,Naa,Sb,Oaa,Paa,Qaa,Yb,Vaa,Xaa,ec,fc,gc,bba,cba,gba,jba,lba,mba,qba,tba,nba,sba,rba,pba,oba,uba,yba,Cba,Dba,Aba,Hc,Ic,Gba,Iba,Mba,Nba,Oba,Pba,Lba,Qba,Sba,dd,Uba,Vba,Xba,Zba,Yba,aca,bca,cca,dca,fca,eca,hca,ica,jca,kca,nca,

                                                        Chrome Cache Entry: 150

                                                        Download File
                                                        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        File Type:HTML document, ASCII text, with very long lines (681)
                                                        Category:downloaded
                                                        Size (bytes):4067
                                                        Entropy (8bit):5.3700036060139436
                                                        Encrypted:false
                                                        SSDEEP:96:G6mTOIiY1medWRQrf7VF6vtDgXJyA7oxcoTiw:3mTOImedWOVF6vtUJyA8xJ3
                                                        MD5:FA701F5D7BEF5AF6B676F099A00A1140
                                                        SHA1:4CA8594D1E845605E7F1242AD8E10FD3A41FA3BE
                                                        SHA-256:F1F311E29B597B507EE761AE40185A9BE194BA6498F91DD2A69610EF765B554A
                                                        SHA-512:D53CAD789CED1F1D05546CD9DDA662FF47DF4A9FE382F4936EB1579175B06A95770426E5A83C24EACE04014956F1971A6432D1FCB26F2A9E4B922D8A34FC9875
                                                        Malicious:false
                                                        URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.PqO-Y4U4tl0.es5.O/ck=boq-identity.AccountsSignInUi.nq70RHujW6U.L.B1.O/am=xMFgKBi2EQjEH54DekBRIOQAAAAAAAAAAKANAAB0DA/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGiXTMuN04FgQ4LzahFtNqboYL9eA/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=sOXFj,q0xTif,ZZ4WUe"
                                                        Preview:"use strict";_F_installCss(".N7rBcd{overflow-x:auto}sentinel{}");.this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.vg(_.bqa);._.k("sOXFj");.var wu=function(a){_.W.call(this,a.Fa)};_.J(wu,_.W);wu.Ba=_.W.Ba;wu.prototype.aa=function(a){return a()};_.qu(_.aqa,wu);._.l();._.k("oGtAuc");._.Bya=new _.pf(_.bqa);._.l();._.k("q0xTif");.var vza=function(a){var b=function(d){_.Zn(d)&&(_.Zn(d).Lc=null,_.Gu(d,null));d.XyHi9&&(d.XyHi9=null)};b(a);a=a.querySelectorAll("[c-wiz]");for(var c=0;c<a.length;c++)b(a[c])},Su=function(a){_.nt.call(this,a.Fa);this.Qa=this.dom=null;if(this.rl()){var b=_.Cm(this.Wg(),[_.Hm,_.Gm]);b=_.pi([b[_.Hm],b[_.Gm]]).then(function(c){this.Qa=c[0];this.dom=c[1]},null,this);_.ku(this,b)}this.Ra=a.lm.Dea};_.J(Su,_.nt);Su.Ba=function(){return{lm:{Dea:function(a){return _.Ue(a)}}}};Su.prototype.Bp=function(a){return this.Ra.Bp(a)};.Su.prototype.getData=function(a){return this.Ra.getData(a)};Su.prototype.uo=function(){_.Nt(this.d

                                                        Static File Info

                                                        General

                                                        File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                        Entropy (8bit):6.583823778284438
                                                        TrID:
                                                        • Win32 Executable (generic) a (10002005/4) 99.96%
                                                        • Generic Win/DOS Executable (2004/3) 0.02%
                                                        • DOS Executable Generic (2002/1) 0.02%
                                                        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                        File name:file.exe
                                                        File size:919'040 bytes
                                                        MD5:e5dee324e4d2c335dc57f68ab1230b91
                                                        SHA1:f12babfaa76b5466b3464b6f7e164a16997a08e9
                                                        SHA256:e1cb3fa706ea73b4ac3d0d19305f935c60ec02466955b08cd959008675d007aa
                                                        SHA512:c0751a1343d1ed92148b5404e8e1a50a47049eaa14e4ee67682edfdf40093d265e314a6a7cedd0923aa62486b8922923a6c4e365251d0acaa0f1bed0d82f536e
                                                        SSDEEP:24576:ZqDEvCTbMWu7rQYlBQcBiT6rprG8a42K:ZTvC/MTQYxsWR7a4
                                                        TLSH:04159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3
                                                        File Content Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

                                                        File Icon

                                                        Icon Hash:aaf3e3e3938382a0

                                                        Static PE Info

                                                        General

                                                        Entrypoint:0x420577
                                                        Entrypoint Section:.text
                                                        Digitally signed:false
                                                        Imagebase:0x400000
                                                        Subsystem:windows gui
                                                        Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                                                        DLL Characteristics:DYNAMIC_BASE, TERMINAL_SERVER_AWARE
                                                        Time Stamp:0x67042BA7 [Mon Oct 7 18:42:47 2024 UTC]
                                                        TLS Callbacks:
                                                        CLR (.Net) Version:
                                                        OS Version Major:5
                                                        OS Version Minor:1
                                                        File Version Major:5
                                                        File Version Minor:1
                                                        Subsystem Version Major:5
                                                        Subsystem Version Minor:1
                                                        Import Hash:948cc502fe9226992dce9417f952fce3

                                                        Entrypoint Preview

                                                        Instruction
                                                        call 00007F37B8DF8333h
                                                        jmp 00007F37B8DF7C3Fh
                                                        push ebp
                                                        mov ebp, esp
                                                        push esi
                                                        push dword ptr [ebp+08h]
                                                        mov esi, ecx
                                                        call 00007F37B8DF7E1Dh
                                                        mov dword ptr [esi], 0049FDF0h
                                                        mov eax, esi
                                                        pop esi
                                                        pop ebp
                                                        retn 0004h
                                                        and dword ptr [ecx+04h], 00000000h
                                                        mov eax, ecx
                                                        and dword ptr [ecx+08h], 00000000h
                                                        mov dword ptr [ecx+04h], 0049FDF8h
                                                        mov dword ptr [ecx], 0049FDF0h
                                                        ret
                                                        push ebp
                                                        mov ebp, esp
                                                        push esi
                                                        push dword ptr [ebp+08h]
                                                        mov esi, ecx
                                                        call 00007F37B8DF7DEAh
                                                        mov dword ptr [esi], 0049FE0Ch
                                                        mov eax, esi
                                                        pop esi
                                                        pop ebp
                                                        retn 0004h
                                                        and dword ptr [ecx+04h], 00000000h
                                                        mov eax, ecx
                                                        and dword ptr [ecx+08h], 00000000h
                                                        mov dword ptr [ecx+04h], 0049FE14h
                                                        mov dword ptr [ecx], 0049FE0Ch
                                                        ret
                                                        push ebp
                                                        mov ebp, esp
                                                        push esi
                                                        mov esi, ecx
                                                        lea eax, dword ptr [esi+04h]
                                                        mov dword ptr [esi], 0049FDD0h
                                                        and dword ptr [eax], 00000000h
                                                        and dword ptr [eax+04h], 00000000h
                                                        push eax
                                                        mov eax, dword ptr [ebp+08h]
                                                        add eax, 04h
                                                        push eax
                                                        call 00007F37B8DFA9DDh
                                                        pop ecx
                                                        pop ecx
                                                        mov eax, esi
                                                        pop esi
                                                        pop ebp
                                                        retn 0004h
                                                        lea eax, dword ptr [ecx+04h]
                                                        mov dword ptr [ecx], 0049FDD0h
                                                        push eax
                                                        call 00007F37B8DFAA28h
                                                        pop ecx
                                                        ret
                                                        push ebp
                                                        mov ebp, esp
                                                        push esi
                                                        mov esi, ecx
                                                        lea eax, dword ptr [esi+04h]
                                                        mov dword ptr [esi], 0049FDD0h
                                                        push eax
                                                        call 00007F37B8DFAA11h
                                                        test byte ptr [ebp+08h], 00000001h
                                                        pop ecx

                                                        Rich Headers

                                                        Programming Language:
                                                        • [ C ] VS2008 SP1 build 30729
                                                        • [IMP] VS2008 SP1 build 30729

                                                        Data Directories

                                                        NameVirtual AddressVirtual Size Is in Section
                                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_IMPORT0xc8e640x17c.rdata
                                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0xd40000x9bb8.rsrc
                                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0xde0000x7594.reloc
                                                        IMAGE_DIRECTORY_ENTRY_DEBUG0xb0ff00x1c.rdata
                                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_TLS0xc34000x18.rdata
                                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0xb10100x40.rdata
                                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_IAT0x9c0000x894.rdata
                                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                        Sections

                                                        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                        .text0x10000x9ab1d0x9ac000a1473f3064dcbc32ef93c5c8a90f3a6False0.565500681542811data6.668273581389308IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                        .rdata0x9c0000x2fb820x2fc00c9cf2468b60bf4f80f136ed54b3989fbFalse0.35289185209424084data5.691811547483722IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                        .data0xcc0000x706c0x480053b9025d545d65e23295e30afdbd16d9False0.04356553819444445DOS executable (block device driver @\273\)0.5846666986982398IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                        .rsrc0xd40000x9bb80x9c00f5a5e45304fa830d3bac96a6ae5d1ef5False0.3167317708333333data5.332831195256247IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                        .reloc0xde0000x75940x7600c68ee8931a32d45eb82dc450ee40efc3False0.7628111758474576data6.7972128181359786IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                        Resources

                                                        NameRVASizeTypeLanguageCountryZLIB Complexity
                                                        RT_ICON0xd45a80x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.7466216216216216
                                                        RT_ICON0xd46d00x128Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colorsEnglishGreat Britain0.3277027027027027
                                                        RT_ICON0xd47f80x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.3885135135135135
                                                        RT_ICON0xd49200x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 0EnglishGreat Britain0.3333333333333333
                                                        RT_ICON0xd4c080x128Device independent bitmap graphic, 16 x 32 x 4, image size 0EnglishGreat Britain0.5
                                                        RT_ICON0xd4d300xea8Device independent bitmap graphic, 48 x 96 x 8, image size 0EnglishGreat Britain0.2835820895522388
                                                        RT_ICON0xd5bd80x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0EnglishGreat Britain0.37906137184115524
                                                        RT_ICON0xd64800x568Device independent bitmap graphic, 16 x 32 x 8, image size 0EnglishGreat Britain0.23699421965317918
                                                        RT_ICON0xd69e80x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0EnglishGreat Britain0.13858921161825727
                                                        RT_ICON0xd8f900x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0EnglishGreat Britain0.25070356472795496
                                                        RT_ICON0xda0380x468Device independent bitmap graphic, 16 x 32 x 32, image size 0EnglishGreat Britain0.3173758865248227
                                                        RT_MENU0xda4a00x50dataEnglishGreat Britain0.9
                                                        RT_STRING0xda4f00x594dataEnglishGreat Britain0.3333333333333333
                                                        RT_STRING0xdaa840x68adataEnglishGreat Britain0.2735961768219833
                                                        RT_STRING0xdb1100x490dataEnglishGreat Britain0.3715753424657534
                                                        RT_STRING0xdb5a00x5fcdataEnglishGreat Britain0.3087467362924282
                                                        RT_STRING0xdbb9c0x65cdataEnglishGreat Britain0.34336609336609336
                                                        RT_STRING0xdc1f80x466dataEnglishGreat Britain0.3605683836589698
                                                        RT_STRING0xdc6600x158Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0EnglishGreat Britain0.502906976744186
                                                        RT_RCDATA0xdc7b80xe7edata1.002964959568733
                                                        RT_GROUP_ICON0xdd6380x76dataEnglishGreat Britain0.6610169491525424
                                                        RT_GROUP_ICON0xdd6b00x14dataEnglishGreat Britain1.25
                                                        RT_GROUP_ICON0xdd6c40x14dataEnglishGreat Britain1.15
                                                        RT_GROUP_ICON0xdd6d80x14dataEnglishGreat Britain1.25
                                                        RT_VERSION0xdd6ec0xdcdataEnglishGreat Britain0.6181818181818182
                                                        RT_MANIFEST0xdd7c80x3efASCII text, with CRLF line terminatorsEnglishGreat Britain0.5074478649453823

                                                        Imports

                                                        DLLImport
                                                        WSOCK32.dllgethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
                                                        VERSION.dllGetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
                                                        WINMM.dlltimeGetTime, waveOutSetVolume, mciSendStringW
                                                        COMCTL32.dllImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
                                                        MPR.dllWNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
                                                        WININET.dllHttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
                                                        PSAPI.DLLGetProcessMemoryInfo
                                                        IPHLPAPI.DLLIcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
                                                        USERENV.dllDestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
                                                        UxTheme.dllIsThemeActive
                                                        KERNEL32.dllDuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
                                                        USER32.dllGetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
                                                        GDI32.dllEndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
                                                        COMDLG32.dllGetSaveFileNameW, GetOpenFileNameW
                                                        ADVAPI32.dllGetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
                                                        SHELL32.dllDragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
                                                        ole32.dllCoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
                                                        OLEAUT32.dllCreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

                                                        Possible Origin

                                                        Language of compilation systemCountry where language is spokenMap
                                                        EnglishGreat Britain

                                                        Network Behavior

                                                        Network Port Distribution

                                                        TCP Packets

                                                        TimestampSource PortDest PortSource IPDest IP
                                                        Oct 7, 2024 20:46:01.084803104 CEST49675443192.168.2.4173.222.162.32
                                                        Oct 7, 2024 20:46:02.343574047 CEST49736443192.168.2.4142.250.185.174
                                                        Oct 7, 2024 20:46:02.343677998 CEST44349736142.250.185.174192.168.2.4
                                                        Oct 7, 2024 20:46:02.343785048 CEST49736443192.168.2.4142.250.185.174
                                                        Oct 7, 2024 20:46:02.344194889 CEST49736443192.168.2.4142.250.185.174
                                                        Oct 7, 2024 20:46:02.344233036 CEST44349736142.250.185.174192.168.2.4
                                                        Oct 7, 2024 20:46:02.940466881 CEST44349736142.250.185.174192.168.2.4
                                                        Oct 7, 2024 20:46:02.940840960 CEST49736443192.168.2.4142.250.185.174
                                                        Oct 7, 2024 20:46:02.940908909 CEST44349736142.250.185.174192.168.2.4
                                                        Oct 7, 2024 20:46:02.941236973 CEST44349736142.250.185.174192.168.2.4
                                                        Oct 7, 2024 20:46:02.941306114 CEST49736443192.168.2.4142.250.185.174
                                                        Oct 7, 2024 20:46:02.941760063 CEST44349736142.250.185.174192.168.2.4
                                                        Oct 7, 2024 20:46:02.941821098 CEST49736443192.168.2.4142.250.185.174
                                                        Oct 7, 2024 20:46:02.942836046 CEST49736443192.168.2.4142.250.185.174
                                                        Oct 7, 2024 20:46:02.942898989 CEST44349736142.250.185.174192.168.2.4
                                                        Oct 7, 2024 20:46:02.943056107 CEST49736443192.168.2.4142.250.185.174
                                                        Oct 7, 2024 20:46:02.943073988 CEST44349736142.250.185.174192.168.2.4
                                                        Oct 7, 2024 20:46:02.994663000 CEST49736443192.168.2.4142.250.185.174
                                                        Oct 7, 2024 20:46:03.243885040 CEST44349736142.250.185.174192.168.2.4
                                                        Oct 7, 2024 20:46:03.243900061 CEST44349736142.250.185.174192.168.2.4
                                                        Oct 7, 2024 20:46:03.244080067 CEST44349736142.250.185.174192.168.2.4
                                                        Oct 7, 2024 20:46:03.244220018 CEST49736443192.168.2.4142.250.185.174
                                                        Oct 7, 2024 20:46:03.244220018 CEST49736443192.168.2.4142.250.185.174
                                                        Oct 7, 2024 20:46:03.246421099 CEST49736443192.168.2.4142.250.185.174
                                                        Oct 7, 2024 20:46:03.246486902 CEST44349736142.250.185.174192.168.2.4
                                                        Oct 7, 2024 20:46:05.605735064 CEST49741443192.168.2.4142.250.185.132
                                                        Oct 7, 2024 20:46:05.605817080 CEST44349741142.250.185.132192.168.2.4
                                                        Oct 7, 2024 20:46:05.605921984 CEST49741443192.168.2.4142.250.185.132
                                                        Oct 7, 2024 20:46:05.606254101 CEST49741443192.168.2.4142.250.185.132
                                                        Oct 7, 2024 20:46:05.606309891 CEST44349741142.250.185.132192.168.2.4
                                                        Oct 7, 2024 20:46:06.261116982 CEST44349741142.250.185.132192.168.2.4
                                                        Oct 7, 2024 20:46:06.261472940 CEST49741443192.168.2.4142.250.185.132
                                                        Oct 7, 2024 20:46:06.261533022 CEST44349741142.250.185.132192.168.2.4
                                                        Oct 7, 2024 20:46:06.263210058 CEST44349741142.250.185.132192.168.2.4
                                                        Oct 7, 2024 20:46:06.263425112 CEST49741443192.168.2.4142.250.185.132
                                                        Oct 7, 2024 20:46:06.264177084 CEST49741443192.168.2.4142.250.185.132
                                                        Oct 7, 2024 20:46:06.264307022 CEST44349741142.250.185.132192.168.2.4
                                                        Oct 7, 2024 20:46:06.317835093 CEST49741443192.168.2.4142.250.185.132
                                                        Oct 7, 2024 20:46:06.317893982 CEST44349741142.250.185.132192.168.2.4
                                                        Oct 7, 2024 20:46:06.364702940 CEST49741443192.168.2.4142.250.185.132
                                                        Oct 7, 2024 20:46:10.306953907 CEST49756443192.168.2.4142.250.185.174
                                                        Oct 7, 2024 20:46:10.307028055 CEST44349756142.250.185.174192.168.2.4
                                                        Oct 7, 2024 20:46:10.307266951 CEST49756443192.168.2.4142.250.185.174
                                                        Oct 7, 2024 20:46:10.307379961 CEST49756443192.168.2.4142.250.185.174
                                                        Oct 7, 2024 20:46:10.307409048 CEST44349756142.250.185.174192.168.2.4
                                                        Oct 7, 2024 20:46:10.908721924 CEST44349756142.250.185.174192.168.2.4
                                                        Oct 7, 2024 20:46:10.909118891 CEST49756443192.168.2.4142.250.185.174
                                                        Oct 7, 2024 20:46:10.909185886 CEST44349756142.250.185.174192.168.2.4
                                                        Oct 7, 2024 20:46:10.909544945 CEST44349756142.250.185.174192.168.2.4
                                                        Oct 7, 2024 20:46:10.909619093 CEST49756443192.168.2.4142.250.185.174
                                                        Oct 7, 2024 20:46:10.910136938 CEST44349756142.250.185.174192.168.2.4
                                                        Oct 7, 2024 20:46:10.910197020 CEST49756443192.168.2.4142.250.185.174
                                                        Oct 7, 2024 20:46:10.911123037 CEST49756443192.168.2.4142.250.185.174
                                                        Oct 7, 2024 20:46:10.911187887 CEST44349756142.250.185.174192.168.2.4
                                                        Oct 7, 2024 20:46:10.911346912 CEST49756443192.168.2.4142.250.185.174
                                                        Oct 7, 2024 20:46:10.911367893 CEST44349756142.250.185.174192.168.2.4
                                                        Oct 7, 2024 20:46:10.957814932 CEST49756443192.168.2.4142.250.185.174
                                                        Oct 7, 2024 20:46:11.216501951 CEST44349756142.250.185.174192.168.2.4
                                                        Oct 7, 2024 20:46:11.216574907 CEST44349756142.250.185.174192.168.2.4
                                                        Oct 7, 2024 20:46:11.216667891 CEST49756443192.168.2.4142.250.185.174
                                                        Oct 7, 2024 20:46:11.216733932 CEST44349756142.250.185.174192.168.2.4
                                                        Oct 7, 2024 20:46:11.216795921 CEST49756443192.168.2.4142.250.185.174
                                                        Oct 7, 2024 20:46:11.216938972 CEST44349756142.250.185.174192.168.2.4
                                                        Oct 7, 2024 20:46:11.216989994 CEST49756443192.168.2.4142.250.185.174
                                                        Oct 7, 2024 20:46:11.222176075 CEST44349756142.250.185.174192.168.2.4
                                                        Oct 7, 2024 20:46:11.222263098 CEST49756443192.168.2.4142.250.185.174
                                                        Oct 7, 2024 20:46:11.228405952 CEST44349756142.250.185.174192.168.2.4
                                                        Oct 7, 2024 20:46:11.228488922 CEST49756443192.168.2.4142.250.185.174
                                                        Oct 7, 2024 20:46:11.228524923 CEST44349756142.250.185.174192.168.2.4
                                                        Oct 7, 2024 20:46:11.228576899 CEST49756443192.168.2.4142.250.185.174
                                                        Oct 7, 2024 20:46:11.234071970 CEST44349756142.250.185.174192.168.2.4
                                                        Oct 7, 2024 20:46:11.234141111 CEST49756443192.168.2.4142.250.185.174
                                                        Oct 7, 2024 20:46:11.240052938 CEST44349756142.250.185.174192.168.2.4
                                                        Oct 7, 2024 20:46:11.240128994 CEST49756443192.168.2.4142.250.185.174
                                                        Oct 7, 2024 20:46:11.240144014 CEST44349756142.250.185.174192.168.2.4
                                                        Oct 7, 2024 20:46:11.240197897 CEST49756443192.168.2.4142.250.185.174
                                                        Oct 7, 2024 20:46:11.299040079 CEST44349756142.250.185.174192.168.2.4
                                                        Oct 7, 2024 20:46:11.299184084 CEST44349756142.250.185.174192.168.2.4
                                                        Oct 7, 2024 20:46:11.299242973 CEST49756443192.168.2.4142.250.185.174
                                                        Oct 7, 2024 20:46:11.299314022 CEST44349756142.250.185.174192.168.2.4
                                                        Oct 7, 2024 20:46:11.299393892 CEST49756443192.168.2.4142.250.185.174
                                                        Oct 7, 2024 20:46:11.301644087 CEST44349756142.250.185.174192.168.2.4
                                                        Oct 7, 2024 20:46:11.301738977 CEST49756443192.168.2.4142.250.185.174
                                                        Oct 7, 2024 20:46:11.310954094 CEST44349756142.250.185.174192.168.2.4
                                                        Oct 7, 2024 20:46:11.311013937 CEST49756443192.168.2.4142.250.185.174
                                                        Oct 7, 2024 20:46:11.311037064 CEST44349756142.250.185.174192.168.2.4
                                                        Oct 7, 2024 20:46:11.311096907 CEST49756443192.168.2.4142.250.185.174
                                                        Oct 7, 2024 20:46:11.313766003 CEST44349756142.250.185.174192.168.2.4
                                                        Oct 7, 2024 20:46:11.313847065 CEST49756443192.168.2.4142.250.185.174
                                                        Oct 7, 2024 20:46:11.319895029 CEST44349756142.250.185.174192.168.2.4
                                                        Oct 7, 2024 20:46:11.319978952 CEST49756443192.168.2.4142.250.185.174
                                                        Oct 7, 2024 20:46:11.319992065 CEST44349756142.250.185.174192.168.2.4
                                                        Oct 7, 2024 20:46:11.325841904 CEST44349756142.250.185.174192.168.2.4
                                                        Oct 7, 2024 20:46:11.325948000 CEST49756443192.168.2.4142.250.185.174
                                                        Oct 7, 2024 20:46:11.325961113 CEST44349756142.250.185.174192.168.2.4
                                                        Oct 7, 2024 20:46:11.332530022 CEST44349756142.250.185.174192.168.2.4
                                                        Oct 7, 2024 20:46:11.332622051 CEST49756443192.168.2.4142.250.185.174
                                                        Oct 7, 2024 20:46:11.332636118 CEST44349756142.250.185.174192.168.2.4
                                                        Oct 7, 2024 20:46:11.332655907 CEST44349756142.250.185.174192.168.2.4
                                                        Oct 7, 2024 20:46:11.332721949 CEST49756443192.168.2.4142.250.185.174
                                                        Oct 7, 2024 20:46:11.345359087 CEST49756443192.168.2.4142.250.185.174
                                                        Oct 7, 2024 20:46:11.345393896 CEST44349756142.250.185.174192.168.2.4
                                                        Oct 7, 2024 20:46:11.368029118 CEST49760443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:11.368062019 CEST44349760142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:11.368138075 CEST49760443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:11.368623972 CEST49760443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:11.368642092 CEST44349760142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:11.424135923 CEST49762443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:11.424201965 CEST44349762142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:11.424280882 CEST49762443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:11.424660921 CEST49762443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:11.424699068 CEST44349762142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:11.982225895 CEST44349760142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:11.982471943 CEST49760443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:11.982501030 CEST44349760142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:11.983011007 CEST44349760142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:11.983076096 CEST49760443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:11.984021902 CEST44349760142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:11.984075069 CEST49760443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:11.984870911 CEST49760443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:11.984951973 CEST44349760142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:11.985090971 CEST49760443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:11.985100031 CEST44349760142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:12.024370909 CEST49760443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:12.064598083 CEST44349762142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:12.064812899 CEST49762443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:12.064836025 CEST44349762142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:12.065349102 CEST44349762142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:12.065419912 CEST49762443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:12.066343069 CEST44349762142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:12.066396952 CEST49762443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:12.066488981 CEST49762443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:12.066566944 CEST44349762142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:12.066591024 CEST49762443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:12.107403040 CEST44349762142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:12.116209984 CEST49762443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:12.116219997 CEST44349762142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:12.162126064 CEST49762443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:12.271759033 CEST44349760142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:12.272173882 CEST49760443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:12.272242069 CEST44349760142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:12.272314072 CEST49760443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:12.272861004 CEST49765443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:12.272886992 CEST44349765142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:12.272969961 CEST49765443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:12.273273945 CEST49765443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:12.273298979 CEST44349765142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:12.353611946 CEST44349762142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:12.353774071 CEST44349762142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:12.353841066 CEST49762443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:12.354023933 CEST49762443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:12.354023933 CEST49762443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:12.354080915 CEST44349762142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:12.354130030 CEST49762443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:12.354712963 CEST49766443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:12.354746103 CEST44349766142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:12.354821920 CEST49766443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:12.355144024 CEST49766443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:12.355170965 CEST44349766142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:12.876163006 CEST44349765142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:12.876327991 CEST49765443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:12.876343966 CEST44349765142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:12.876955986 CEST44349765142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:12.877015114 CEST49765443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:12.878084898 CEST44349765142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:12.878134966 CEST49765443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:12.878221989 CEST49765443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:12.878304005 CEST44349765142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:12.878330946 CEST49765443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:12.878331900 CEST49765443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:12.878370047 CEST44349765142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:12.927624941 CEST49765443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:12.927640915 CEST44349765142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:12.965579033 CEST44349766142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:12.965750933 CEST49766443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:12.965771914 CEST44349766142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:12.966465950 CEST44349766142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:12.966540098 CEST49766443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:12.967495918 CEST44349766142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:12.967550993 CEST49766443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:12.967662096 CEST49766443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:12.967751980 CEST44349766142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:12.967766047 CEST49766443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:12.967766047 CEST49766443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:12.967833042 CEST44349766142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:12.974495888 CEST49765443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:13.021364927 CEST49766443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:13.021380901 CEST44349766142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:13.068245888 CEST49766443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:13.086255074 CEST44349765142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:13.086427927 CEST44349765142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:13.086483955 CEST49765443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:13.087654114 CEST49765443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:13.087687016 CEST44349765142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:13.112011909 CEST49741443192.168.2.4142.250.185.132
                                                        Oct 7, 2024 20:46:13.155431986 CEST44349741142.250.185.132192.168.2.4
                                                        Oct 7, 2024 20:46:13.179440022 CEST44349766142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:13.180345058 CEST44349766142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:13.180424929 CEST49766443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:13.184273958 CEST49766443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:13.184318066 CEST44349766142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:13.369724035 CEST44349741142.250.185.132192.168.2.4
                                                        Oct 7, 2024 20:46:13.369847059 CEST44349741142.250.185.132192.168.2.4
                                                        Oct 7, 2024 20:46:13.369918108 CEST49741443192.168.2.4142.250.185.132
                                                        Oct 7, 2024 20:46:13.369937897 CEST44349741142.250.185.132192.168.2.4
                                                        Oct 7, 2024 20:46:13.369966984 CEST44349741142.250.185.132192.168.2.4
                                                        Oct 7, 2024 20:46:13.370099068 CEST44349741142.250.185.132192.168.2.4
                                                        Oct 7, 2024 20:46:13.370155096 CEST49741443192.168.2.4142.250.185.132
                                                        Oct 7, 2024 20:46:13.370179892 CEST44349741142.250.185.132192.168.2.4
                                                        Oct 7, 2024 20:46:13.370341063 CEST44349741142.250.185.132192.168.2.4
                                                        Oct 7, 2024 20:46:13.370394945 CEST49741443192.168.2.4142.250.185.132
                                                        Oct 7, 2024 20:46:13.370764971 CEST49741443192.168.2.4142.250.185.132
                                                        Oct 7, 2024 20:46:13.370790958 CEST44349741142.250.185.132192.168.2.4
                                                        Oct 7, 2024 20:46:14.290621042 CEST49769443192.168.2.44.175.87.197
                                                        Oct 7, 2024 20:46:14.290705919 CEST443497694.175.87.197192.168.2.4
                                                        Oct 7, 2024 20:46:14.292001963 CEST49769443192.168.2.44.175.87.197
                                                        Oct 7, 2024 20:46:14.292892933 CEST49769443192.168.2.44.175.87.197
                                                        Oct 7, 2024 20:46:14.292928934 CEST443497694.175.87.197192.168.2.4
                                                        Oct 7, 2024 20:46:15.092818022 CEST443497694.175.87.197192.168.2.4
                                                        Oct 7, 2024 20:46:15.092900038 CEST49769443192.168.2.44.175.87.197
                                                        Oct 7, 2024 20:46:15.095628977 CEST49769443192.168.2.44.175.87.197
                                                        Oct 7, 2024 20:46:15.095659018 CEST443497694.175.87.197192.168.2.4
                                                        Oct 7, 2024 20:46:15.096082926 CEST443497694.175.87.197192.168.2.4
                                                        Oct 7, 2024 20:46:15.145981073 CEST49769443192.168.2.44.175.87.197
                                                        Oct 7, 2024 20:46:15.759696960 CEST49769443192.168.2.44.175.87.197
                                                        Oct 7, 2024 20:46:15.803430080 CEST443497694.175.87.197192.168.2.4
                                                        Oct 7, 2024 20:46:16.015990019 CEST443497694.175.87.197192.168.2.4
                                                        Oct 7, 2024 20:46:16.016025066 CEST443497694.175.87.197192.168.2.4
                                                        Oct 7, 2024 20:46:16.016035080 CEST443497694.175.87.197192.168.2.4
                                                        Oct 7, 2024 20:46:16.016077995 CEST49769443192.168.2.44.175.87.197
                                                        Oct 7, 2024 20:46:16.016139030 CEST443497694.175.87.197192.168.2.4
                                                        Oct 7, 2024 20:46:16.016170025 CEST443497694.175.87.197192.168.2.4
                                                        Oct 7, 2024 20:46:16.016189098 CEST443497694.175.87.197192.168.2.4
                                                        Oct 7, 2024 20:46:16.016230106 CEST49769443192.168.2.44.175.87.197
                                                        Oct 7, 2024 20:46:16.016230106 CEST49769443192.168.2.44.175.87.197
                                                        Oct 7, 2024 20:46:16.016230106 CEST49769443192.168.2.44.175.87.197
                                                        Oct 7, 2024 20:46:16.016263962 CEST49769443192.168.2.44.175.87.197
                                                        Oct 7, 2024 20:46:16.017185926 CEST443497694.175.87.197192.168.2.4
                                                        Oct 7, 2024 20:46:16.017268896 CEST49769443192.168.2.44.175.87.197
                                                        Oct 7, 2024 20:46:16.017281055 CEST443497694.175.87.197192.168.2.4
                                                        Oct 7, 2024 20:46:16.017347097 CEST443497694.175.87.197192.168.2.4
                                                        Oct 7, 2024 20:46:16.017402887 CEST49769443192.168.2.44.175.87.197
                                                        Oct 7, 2024 20:46:16.715745926 CEST49769443192.168.2.44.175.87.197
                                                        Oct 7, 2024 20:46:16.715745926 CEST49769443192.168.2.44.175.87.197
                                                        Oct 7, 2024 20:46:16.715814114 CEST443497694.175.87.197192.168.2.4
                                                        Oct 7, 2024 20:46:16.715847969 CEST443497694.175.87.197192.168.2.4
                                                        Oct 7, 2024 20:46:19.177005053 CEST4972380192.168.2.493.184.221.240
                                                        Oct 7, 2024 20:46:19.183710098 CEST804972393.184.221.240192.168.2.4
                                                        Oct 7, 2024 20:46:19.183795929 CEST4972380192.168.2.493.184.221.240
                                                        Oct 7, 2024 20:46:19.430579901 CEST49780443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:19.430635929 CEST44349780142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:19.430705070 CEST49780443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:19.430996895 CEST49780443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:19.431020021 CEST44349780142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:20.067784071 CEST44349780142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:20.068273067 CEST49780443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:20.068311930 CEST44349780142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:20.069526911 CEST44349780142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:20.069818974 CEST49780443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:20.069950104 CEST49780443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:20.069969893 CEST44349780142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:20.069993019 CEST49780443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:20.070061922 CEST44349780142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:20.116082907 CEST49780443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:20.374185085 CEST44349780142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:20.374524117 CEST44349780142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:20.374583006 CEST49780443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:20.375591993 CEST49780443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:20.375621080 CEST44349780142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:23.374617100 CEST6016253192.168.2.41.1.1.1
                                                        Oct 7, 2024 20:46:23.380165100 CEST53601621.1.1.1192.168.2.4
                                                        Oct 7, 2024 20:46:23.380222082 CEST6016253192.168.2.41.1.1.1
                                                        Oct 7, 2024 20:46:23.380275011 CEST6016253192.168.2.41.1.1.1
                                                        Oct 7, 2024 20:46:23.385618925 CEST53601621.1.1.1192.168.2.4
                                                        Oct 7, 2024 20:46:23.806932926 CEST53601621.1.1.1192.168.2.4
                                                        Oct 7, 2024 20:46:23.808124065 CEST6016253192.168.2.41.1.1.1
                                                        Oct 7, 2024 20:46:23.813479900 CEST53601621.1.1.1192.168.2.4
                                                        Oct 7, 2024 20:46:23.815104961 CEST6016253192.168.2.41.1.1.1
                                                        Oct 7, 2024 20:46:42.243298054 CEST60164443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:42.243413925 CEST44360164142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:42.243494987 CEST60164443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:42.243855953 CEST60164443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:42.243937016 CEST44360164142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:42.936872005 CEST44360164142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:42.937225103 CEST60164443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:42.937288046 CEST44360164142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:42.938522100 CEST44360164142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:42.938807964 CEST60164443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:42.938987970 CEST44360164142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:42.939027071 CEST60164443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:42.939055920 CEST60164443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:42.939084053 CEST44360164142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:43.227992058 CEST44360164142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:43.228311062 CEST44360164142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:43.228508949 CEST60164443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:43.228765011 CEST60164443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:43.228807926 CEST44360164142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:43.715112925 CEST60165443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:43.715205908 CEST44360165142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:43.715281963 CEST60165443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:43.715610027 CEST60165443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:43.715643883 CEST44360165142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:43.930110931 CEST60166443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:43.930201054 CEST44360166142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:43.930315018 CEST60166443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:43.930516958 CEST60166443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:43.930537939 CEST44360166142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:44.566556931 CEST44360166142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:44.566705942 CEST44360165142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:44.567289114 CEST60165443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:44.567318916 CEST44360165142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:44.567394972 CEST60166443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:44.567406893 CEST44360166142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:44.568039894 CEST44360165142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:44.568056107 CEST44360166142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:44.568465948 CEST60166443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:44.568619013 CEST60165443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:44.568727970 CEST44360166142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:44.568741083 CEST60166443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:44.568756104 CEST60166443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:44.568794012 CEST44360165142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:44.568806887 CEST44360166142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:44.568819046 CEST60165443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:44.568856001 CEST60165443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:44.568897009 CEST44360165142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:44.615360975 CEST60166443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:44.855659962 CEST44360166142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:44.856412888 CEST44360166142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:44.856602907 CEST60166443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:44.856776953 CEST60166443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:44.856822014 CEST44360166142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:44.858016014 CEST44360165142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:44.858850002 CEST44360165142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:44.858918905 CEST60165443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:44.859302998 CEST60165443192.168.2.4142.250.185.238
                                                        Oct 7, 2024 20:46:44.859322071 CEST44360165142.250.185.238192.168.2.4
                                                        Oct 7, 2024 20:46:53.170378923 CEST60167443192.168.2.44.175.87.197
                                                        Oct 7, 2024 20:46:53.170469999 CEST443601674.175.87.197192.168.2.4
                                                        Oct 7, 2024 20:46:53.170556068 CEST60167443192.168.2.44.175.87.197
                                                        Oct 7, 2024 20:46:53.171123028 CEST60167443192.168.2.44.175.87.197
                                                        Oct 7, 2024 20:46:53.171205997 CEST443601674.175.87.197192.168.2.4
                                                        Oct 7, 2024 20:46:53.987219095 CEST443601674.175.87.197192.168.2.4
                                                        Oct 7, 2024 20:46:53.987400055 CEST60167443192.168.2.44.175.87.197
                                                        Oct 7, 2024 20:46:53.991255999 CEST60167443192.168.2.44.175.87.197
                                                        Oct 7, 2024 20:46:53.991309881 CEST443601674.175.87.197192.168.2.4
                                                        Oct 7, 2024 20:46:53.991831064 CEST443601674.175.87.197192.168.2.4
                                                        Oct 7, 2024 20:46:53.999501944 CEST60167443192.168.2.44.175.87.197
                                                        Oct 7, 2024 20:46:54.047483921 CEST443601674.175.87.197192.168.2.4
                                                        Oct 7, 2024 20:46:54.318178892 CEST443601674.175.87.197192.168.2.4
                                                        Oct 7, 2024 20:46:54.318268061 CEST443601674.175.87.197192.168.2.4
                                                        Oct 7, 2024 20:46:54.318326950 CEST443601674.175.87.197192.168.2.4
                                                        Oct 7, 2024 20:46:54.318453074 CEST60167443192.168.2.44.175.87.197
                                                        Oct 7, 2024 20:46:54.318454027 CEST60167443192.168.2.44.175.87.197
                                                        Oct 7, 2024 20:46:54.318520069 CEST443601674.175.87.197192.168.2.4
                                                        Oct 7, 2024 20:46:54.318599939 CEST60167443192.168.2.44.175.87.197
                                                        Oct 7, 2024 20:46:54.319140911 CEST443601674.175.87.197192.168.2.4
                                                        Oct 7, 2024 20:46:54.319202900 CEST443601674.175.87.197192.168.2.4
                                                        Oct 7, 2024 20:46:54.319335938 CEST60167443192.168.2.44.175.87.197
                                                        Oct 7, 2024 20:46:54.319336891 CEST60167443192.168.2.44.175.87.197
                                                        Oct 7, 2024 20:46:54.319377899 CEST443601674.175.87.197192.168.2.4
                                                        Oct 7, 2024 20:46:54.319442034 CEST60167443192.168.2.44.175.87.197
                                                        Oct 7, 2024 20:46:54.415822983 CEST60167443192.168.2.44.175.87.197
                                                        Oct 7, 2024 20:46:54.415822983 CEST60167443192.168.2.44.175.87.197
                                                        Oct 7, 2024 20:46:54.415890932 CEST443601674.175.87.197192.168.2.4
                                                        Oct 7, 2024 20:46:54.415925980 CEST443601674.175.87.197192.168.2.4
                                                        Oct 7, 2024 20:46:55.025702000 CEST60168443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:55.025789976 CEST4436016813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:55.025893927 CEST60168443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:55.026453018 CEST60168443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:55.026535034 CEST4436016813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:55.731084108 CEST4436016813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:55.731296062 CEST60168443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:55.732985973 CEST60168443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:55.733040094 CEST4436016813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:55.733460903 CEST4436016813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:55.748416901 CEST60168443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:55.791484118 CEST4436016813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:55.849833965 CEST4436016813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:55.849888086 CEST4436016813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:55.850024939 CEST4436016813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:55.850106955 CEST60168443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:55.850106955 CEST60168443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:55.850171089 CEST4436016813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:55.850244045 CEST60168443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:55.936842918 CEST4436016813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:55.936889887 CEST4436016813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:55.936937094 CEST60168443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:55.937000990 CEST4436016813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:55.937041998 CEST60168443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:55.937062979 CEST60168443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:55.938155890 CEST4436016813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:55.938199043 CEST4436016813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:55.938246012 CEST60168443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:55.938309908 CEST4436016813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:55.938354015 CEST60168443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:55.939239025 CEST60168443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.025038958 CEST4436016813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.025080919 CEST4436016813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.025136948 CEST60168443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.025136948 CEST60168443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.025199890 CEST4436016813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.025321007 CEST60168443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.026401043 CEST4436016813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.026439905 CEST4436016813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.026489973 CEST60168443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.026489973 CEST60168443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.026551962 CEST4436016813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.026617050 CEST60168443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.027839899 CEST4436016813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.027878046 CEST4436016813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.027920008 CEST60168443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.027982950 CEST4436016813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.028021097 CEST60168443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.028044939 CEST60168443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.084660053 CEST4436016813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.084700108 CEST4436016813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.084772110 CEST60168443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.084772110 CEST60168443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.084835052 CEST4436016813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.087321043 CEST60168443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.114017010 CEST4436016813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.114058971 CEST4436016813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.114224911 CEST60168443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.114224911 CEST60168443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.114289045 CEST4436016813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.115489960 CEST60168443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.115757942 CEST4436016813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.115797043 CEST4436016813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.115871906 CEST60168443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.115873098 CEST60168443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.115873098 CEST60168443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.115938902 CEST4436016813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.116008043 CEST60168443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.116553068 CEST4436016813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.116592884 CEST4436016813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.116641045 CEST60168443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.116641998 CEST60168443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.116705894 CEST4436016813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.116766930 CEST60168443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.118282080 CEST4436016813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.118319988 CEST4436016813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.118349075 CEST60168443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.118366957 CEST4436016813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.118393898 CEST60168443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.118413925 CEST60168443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.120342016 CEST4436016813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.120384932 CEST4436016813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.120424986 CEST60168443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.120439053 CEST4436016813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.120471954 CEST60168443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.122240067 CEST60168443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.157902002 CEST4436016813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.157944918 CEST4436016813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.158092022 CEST4436016813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.158107996 CEST60168443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.158108950 CEST60168443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.158133984 CEST4436016813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.158169985 CEST60168443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.158200026 CEST60168443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.158299923 CEST60168443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.158344030 CEST4436016813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.158375025 CEST60168443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.158390999 CEST4436016813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.197784901 CEST60169443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.197849989 CEST4436016913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.197954893 CEST60169443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.199883938 CEST60170443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.199904919 CEST4436017013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.199971914 CEST60171443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.200014114 CEST60169443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.200041056 CEST4436016913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.200054884 CEST4436017113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.200071096 CEST60170443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.200113058 CEST60170443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.200122118 CEST4436017013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.200131893 CEST60171443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.200768948 CEST60171443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.200846910 CEST4436017113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.201231956 CEST60172443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.201314926 CEST4436017213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.201976061 CEST60173443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.202059984 CEST4436017313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.202102900 CEST60172443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.202104092 CEST60172443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.202234983 CEST4436017213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.202299118 CEST60173443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.202347040 CEST60173443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.202364922 CEST4436017313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.813280106 CEST4436016913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.817596912 CEST4436017013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.822894096 CEST4436017213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.825764894 CEST4436017113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.830336094 CEST4436017313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.834084988 CEST60173443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.834176064 CEST4436017313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.834960938 CEST60173443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.834974051 CEST4436017313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.835481882 CEST60171443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.835558891 CEST4436017113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.835917950 CEST60171443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.835971117 CEST4436017113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.835975885 CEST60169443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.836004972 CEST4436016913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.836277962 CEST60169443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.836291075 CEST4436016913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.836446047 CEST60170443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.836473942 CEST4436017013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.836752892 CEST60170443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.836764097 CEST4436017013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.837002039 CEST60172443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.837084055 CEST4436017213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.837193012 CEST60172443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.837208986 CEST4436017213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.928926945 CEST4436016913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.928989887 CEST4436016913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.929008007 CEST4436017313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.929073095 CEST60169443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.929106951 CEST4436016913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.929135084 CEST4436016913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.929164886 CEST60169443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.929183006 CEST4436017313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.929192066 CEST60169443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.929263115 CEST60173443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.929497004 CEST60169443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.929533005 CEST4436016913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.929567099 CEST60169443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.929580927 CEST4436016913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.929795027 CEST4436017113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.929852962 CEST4436017113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.929929018 CEST60171443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.929992914 CEST4436017113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.930052042 CEST60171443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.930087090 CEST4436017013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.930244923 CEST4436017013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.930305004 CEST60170443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.930659056 CEST4436017113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.930805922 CEST4436017113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.930870056 CEST60171443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.930947065 CEST4436017213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.930988073 CEST4436017213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.931070089 CEST60172443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.931138039 CEST4436017213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.931174040 CEST4436017213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.931230068 CEST60172443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.931468964 CEST60171443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.931499958 CEST4436017113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.931526899 CEST60171443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.931541920 CEST4436017113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.932553053 CEST60170443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.932570934 CEST4436017013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.932595015 CEST60170443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.932605982 CEST4436017013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.933501959 CEST60172443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.933538914 CEST4436017213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.933567047 CEST60172443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.933582067 CEST4436017213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.934608936 CEST60173443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.934684992 CEST4436017313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.934720039 CEST60173443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.934739113 CEST4436017313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.938194990 CEST60174443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.938241959 CEST4436017413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.938435078 CEST60174443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.939440966 CEST60174443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.939472914 CEST4436017413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.940666914 CEST60175443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.940751076 CEST4436017513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.941031933 CEST60175443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.941031933 CEST60175443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.941087961 CEST60176443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.941154957 CEST4436017513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.941171885 CEST4436017613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.941245079 CEST60176443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.941397905 CEST60177443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.941446066 CEST4436017713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.941499949 CEST60176443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.941509962 CEST60177443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.941534042 CEST4436017613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.941576004 CEST60177443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.941584110 CEST4436017713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.942261934 CEST60178443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.942270994 CEST4436017813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:56.942332029 CEST60178443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.942420959 CEST60178443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:56.942425013 CEST4436017813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:57.615703106 CEST4436017813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:57.616106033 CEST4436017513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:57.616322994 CEST4436017613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:57.616381884 CEST60178443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:57.616446018 CEST4436017813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:57.616553068 CEST60175443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:57.616610050 CEST4436017513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:57.616889000 CEST60178443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:57.616903067 CEST4436017813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:57.617149115 CEST60175443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:57.617163897 CEST4436017513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:57.617335081 CEST60176443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:57.617418051 CEST4436017613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:57.617518902 CEST60176443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:57.617542028 CEST4436017613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:57.629637957 CEST4436017413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:57.630043983 CEST60174443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:57.630120039 CEST4436017413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:57.630312920 CEST60174443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:57.630327940 CEST4436017413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:57.630911112 CEST4436017713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:57.631311893 CEST60177443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:57.631326914 CEST4436017713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:57.631875992 CEST60177443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:57.631887913 CEST4436017713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:57.711759090 CEST4436017513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:57.711909056 CEST4436017513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:57.712106943 CEST60175443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:57.712106943 CEST60175443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:57.712213993 CEST60175443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:57.712251902 CEST4436017513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:57.714646101 CEST4436017813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:57.714670897 CEST4436017613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:57.714834929 CEST4436017613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:57.714885950 CEST4436017813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:57.714943886 CEST60178443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:57.715055943 CEST60176443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:57.715055943 CEST60179443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:57.715055943 CEST60176443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:57.715126991 CEST60178443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:57.715126991 CEST60178443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:57.715150118 CEST4436017813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:57.715162992 CEST4436017813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:57.715173960 CEST4436017913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:57.715224981 CEST60176443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:57.715245962 CEST4436017613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:57.715281010 CEST60179443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:57.715893030 CEST60179443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:57.715970993 CEST4436017913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:57.717573881 CEST60180443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:57.717657089 CEST4436018013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:57.717926025 CEST60181443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:57.717958927 CEST4436018113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:57.717957020 CEST60180443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:57.717957020 CEST60180443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:57.718024969 CEST60181443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:57.718085051 CEST4436018013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:57.718203068 CEST60181443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:57.718209982 CEST4436018113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:57.727732897 CEST4436017713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:57.727910995 CEST4436017713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:57.727991104 CEST60177443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:57.728044033 CEST60177443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:57.728061914 CEST4436017713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:57.728082895 CEST60177443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:57.728096008 CEST4436017713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:57.730511904 CEST60182443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:57.730551958 CEST4436018213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:57.730633020 CEST60182443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:57.730781078 CEST60182443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:57.730796099 CEST4436018213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:57.748219967 CEST4436017413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:57.748378038 CEST4436017413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:57.748449087 CEST60174443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:57.748527050 CEST60174443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:57.748563051 CEST4436017413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:57.748588085 CEST60174443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:57.748603106 CEST4436017413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:57.750845909 CEST60183443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:57.750930071 CEST4436018313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:57.751182079 CEST60183443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:57.751290083 CEST60183443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:57.751318932 CEST4436018313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:58.344858885 CEST4436018013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:58.345623016 CEST60180443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:58.345679998 CEST4436018013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:58.346190929 CEST60180443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:58.346244097 CEST4436018013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:58.346394062 CEST4436017913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:58.346856117 CEST60179443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:58.346915007 CEST4436017913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:58.347232103 CEST60179443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:58.347285986 CEST4436017913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:58.348438025 CEST4436018213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:58.348701000 CEST60182443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:58.348718882 CEST4436018213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:58.348989010 CEST60182443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:58.348994970 CEST4436018213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:58.365151882 CEST4436018313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:58.365690947 CEST60183443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:58.365734100 CEST4436018313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:58.366182089 CEST60183443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:58.366195917 CEST4436018313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:58.367283106 CEST4436018113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:58.367686033 CEST60181443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:58.367703915 CEST4436018113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:58.367974043 CEST60181443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:58.367980003 CEST4436018113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:58.440573931 CEST4436018013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:58.440727949 CEST4436018013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:58.440819979 CEST60180443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:58.440951109 CEST60180443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:58.440994978 CEST4436018013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:58.441024065 CEST60180443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:58.441040039 CEST4436018013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:58.443737984 CEST4436017913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:58.443886042 CEST4436017913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:58.444108963 CEST60179443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:58.444109917 CEST60179443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:58.444109917 CEST60179443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:58.444328070 CEST60184443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:58.444425106 CEST4436018413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:58.444530964 CEST60184443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:58.444631100 CEST60184443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:58.444649935 CEST4436018413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:58.445202112 CEST4436018213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:58.445353031 CEST4436018213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:58.445416927 CEST60182443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:58.445458889 CEST60182443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:58.445477962 CEST4436018213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:58.445489883 CEST60182443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:58.445497990 CEST4436018213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:58.446530104 CEST60185443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:58.446614981 CEST4436018513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:58.446712971 CEST60185443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:58.446805954 CEST60185443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:58.446835041 CEST4436018513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:58.447669029 CEST60186443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:58.447690964 CEST4436018613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:58.447770119 CEST60186443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:58.447958946 CEST60186443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:58.447983027 CEST4436018613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:58.467154980 CEST4436018113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:58.467289925 CEST4436018113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:58.467350006 CEST60181443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:58.467411041 CEST60181443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:58.467417002 CEST4436018113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:58.467437983 CEST60181443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:58.467442036 CEST4436018113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:58.468843937 CEST4436018313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:58.468991041 CEST4436018313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:58.469084978 CEST60183443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:58.469178915 CEST60183443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:58.469178915 CEST60183443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:58.469222069 CEST4436018313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:58.469254971 CEST4436018313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:58.469530106 CEST60187443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:58.469553947 CEST4436018713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:58.469623089 CEST60187443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:58.469799995 CEST60187443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:58.469827890 CEST4436018713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:58.471448898 CEST60188443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:58.471503019 CEST4436018813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:58.471720934 CEST60188443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:58.471913099 CEST60188443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:58.471940994 CEST4436018813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:58.755956888 CEST60179443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:58.756019115 CEST4436017913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.070897102 CEST4436018513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.074173927 CEST60185443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.074233055 CEST4436018513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.074744940 CEST60185443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.074759960 CEST4436018513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.080893993 CEST4436018613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.081403971 CEST60186443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.081417084 CEST4436018613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.082094908 CEST60186443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.082149029 CEST4436018613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.088247061 CEST4436018813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.088318110 CEST4436018413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.088664055 CEST60188443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.088690996 CEST4436018813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.089236021 CEST60188443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.089246988 CEST4436018813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.093854904 CEST60184443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.093931913 CEST4436018413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.094464064 CEST60184443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.094479084 CEST4436018413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.177599907 CEST4436018713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.179065943 CEST4436018513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.179231882 CEST4436018513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.179459095 CEST60185443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.179802895 CEST4436018613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.180003881 CEST4436018613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.180182934 CEST60186443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.182791948 CEST4436018813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.182936907 CEST4436018813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.183011055 CEST60188443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.183805943 CEST60187443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.183830023 CEST4436018713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.184209108 CEST60187443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.184218884 CEST4436018713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.184382915 CEST60188443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.184382915 CEST60188443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.184416056 CEST4436018813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.184437037 CEST4436018813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.190450907 CEST4436018413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.190593004 CEST4436018413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.190660954 CEST60184443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.201165915 CEST60184443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.201204062 CEST4436018413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.201230049 CEST60184443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.201244116 CEST4436018413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.205725908 CEST60185443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.205725908 CEST60185443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.205791950 CEST4436018513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.205806971 CEST4436018513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.206571102 CEST60186443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.206571102 CEST60186443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.206639051 CEST4436018613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.206672907 CEST4436018613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.213222027 CEST60189443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.213304996 CEST4436018913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.213414907 CEST60189443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.213854074 CEST60189443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.213931084 CEST4436018913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.231456995 CEST60190443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.231539011 CEST4436019013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.231623888 CEST60190443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.233268976 CEST60191443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.233324051 CEST4436019113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.233386993 CEST60191443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.233553886 CEST60191443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.233572006 CEST4436019113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.234941959 CEST60192443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.234961987 CEST4436019213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.235023975 CEST60192443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.242774010 CEST60190443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.242852926 CEST4436019013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.243365049 CEST60192443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.243403912 CEST4436019213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.276864052 CEST4436018713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.276943922 CEST4436018713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.277000904 CEST60187443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.277282953 CEST60187443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.277282953 CEST60187443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.277307987 CEST4436018713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.277328968 CEST4436018713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.279912949 CEST60193443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.279995918 CEST4436019313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.280102968 CEST60193443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.280436039 CEST60193443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.280505896 CEST4436019313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.829312086 CEST4436018913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.829864979 CEST60189443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.829924107 CEST4436018913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.830293894 CEST60189443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.830348015 CEST4436018913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.852900028 CEST4436019213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.853209019 CEST60192443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.853238106 CEST4436019213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.853527069 CEST60192443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.853537083 CEST4436019213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.856627941 CEST4436019113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.856890917 CEST60191443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.856904030 CEST4436019113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.857167006 CEST60191443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.857177019 CEST4436019113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.882647038 CEST4436019013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.883095026 CEST60190443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.883172989 CEST4436019013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.883244991 CEST60190443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.883260012 CEST4436019013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.906265020 CEST4436019313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.906574011 CEST60193443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.906652927 CEST4436019313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.906904936 CEST60193443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.906919003 CEST4436019313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.953012943 CEST4436019213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.953155041 CEST4436019213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.953223944 CEST60192443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.953433990 CEST60192443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.953459978 CEST4436019213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.953505993 CEST60192443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.953520060 CEST4436019213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.954242945 CEST4436019113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.954407930 CEST4436019113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.954469919 CEST60191443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.954495907 CEST60191443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.954507113 CEST4436019113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.954530001 CEST60191443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.954539061 CEST4436019113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.956214905 CEST60195443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.956255913 CEST4436019513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.956315041 CEST60194443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.956326962 CEST60195443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.956396103 CEST4436019413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.956437111 CEST60195443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.956449986 CEST4436019513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.956463099 CEST60194443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.956602097 CEST60194443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.956638098 CEST4436019413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.981466055 CEST4436019013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.981620073 CEST4436019013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.981848001 CEST60190443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.983447075 CEST60196443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.983484983 CEST60190443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.983485937 CEST60190443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.983505011 CEST4436019613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.983550072 CEST4436019013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.983582973 CEST4436019013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:46:59.983592033 CEST60196443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.983711958 CEST60196443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:46:59.983726025 CEST4436019613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:00.001746893 CEST4436018913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:00.001900911 CEST4436018913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:00.002114058 CEST60189443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.002114058 CEST60189443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.002706051 CEST60189443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.002765894 CEST4436018913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:00.003946066 CEST60197443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.004029989 CEST4436019713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:00.004118919 CEST60197443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.004223108 CEST60197443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.004242897 CEST4436019713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:00.005532980 CEST4436019313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:00.005700111 CEST4436019313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:00.005760908 CEST60193443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.005800962 CEST60193443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.005800962 CEST60193443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.005820036 CEST4436019313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:00.005836964 CEST4436019313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:00.009011984 CEST60198443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.009038925 CEST4436019813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:00.009265900 CEST60198443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.009265900 CEST60198443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.009397030 CEST4436019813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:00.592264891 CEST4436019413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:00.596550941 CEST4436019613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:00.611346960 CEST60194443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.611398935 CEST4436019413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:00.611991882 CEST60194443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.612016916 CEST4436019413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:00.612236023 CEST60196443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.612299919 CEST4436019613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:00.612591028 CEST60196443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.612606049 CEST4436019613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:00.620261908 CEST4436019813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:00.620701075 CEST60198443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.620786905 CEST4436019813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:00.621191025 CEST60198443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.621244907 CEST4436019813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:00.624937057 CEST4436019513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:00.625355959 CEST60195443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.625413895 CEST4436019513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:00.625858068 CEST60195443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.625870943 CEST4436019513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:00.630250931 CEST4436019713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:00.630517960 CEST60197443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.630578041 CEST4436019713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:00.631181002 CEST60197443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.631194115 CEST4436019713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:00.703675032 CEST4436019413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:00.703799963 CEST4436019413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:00.703999043 CEST60194443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.704044104 CEST60194443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.704061985 CEST4436019413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:00.704304934 CEST60194443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.704335928 CEST4436019413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:00.704668045 CEST4436019613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:00.704818964 CEST4436019613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:00.704927921 CEST60196443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.704927921 CEST60196443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.704927921 CEST60196443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.706707001 CEST60199443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.706773043 CEST4436019913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:00.706856012 CEST60199443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.706887007 CEST60200443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.706947088 CEST4436020013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:00.707014084 CEST60200443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.707032919 CEST60199443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.707051039 CEST4436019913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:00.707139969 CEST60200443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.707169056 CEST4436020013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:00.715567112 CEST4436019813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:00.715714931 CEST4436019813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:00.715805054 CEST60198443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.715806007 CEST60198443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.715806007 CEST60198443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.717932940 CEST60201443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.717973948 CEST4436020113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:00.718039036 CEST60201443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.718132973 CEST60201443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.718143940 CEST4436020113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:00.725650072 CEST4436019513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:00.725791931 CEST4436019513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:00.725888968 CEST60195443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.725888968 CEST60195443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.727366924 CEST4436019713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:00.727440119 CEST60195443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.727478027 CEST4436019513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:00.727559090 CEST4436019713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:00.727750063 CEST60197443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.727751017 CEST60197443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.727961063 CEST60202443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.727972031 CEST4436020213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:00.728030920 CEST60202443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.728126049 CEST60197443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.728137970 CEST60202443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.728143930 CEST4436020213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:00.728188038 CEST4436019713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:00.729844093 CEST60203443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.729924917 CEST4436020313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:00.730006933 CEST60203443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.730122089 CEST60203443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:00.730139971 CEST4436020313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:01.005832911 CEST60196443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:01.005917072 CEST4436019613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:01.021586895 CEST60198443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:01.021647930 CEST4436019813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:01.333168030 CEST4436019913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:01.333867073 CEST60199443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:01.333921909 CEST4436020013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:01.333946943 CEST4436019913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:01.334418058 CEST60199443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:01.334430933 CEST4436019913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:01.334949970 CEST60200443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:01.334985018 CEST4436020013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:01.335429907 CEST60200443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:01.335454941 CEST4436020013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:01.338280916 CEST4436020313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:01.338686943 CEST60203443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:01.338699102 CEST4436020313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:01.339199066 CEST60203443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:01.339225054 CEST4436020313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:01.360042095 CEST4436020113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:01.360444069 CEST60201443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:01.360459089 CEST4436020113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:01.360990047 CEST60201443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:01.360996008 CEST4436020113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:01.372843981 CEST4436020213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:01.373102903 CEST60202443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:01.373117924 CEST4436020213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:01.373486042 CEST60202443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:01.373491049 CEST4436020213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:01.427850962 CEST4436019913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:01.428005934 CEST4436019913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:01.428122997 CEST60199443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:01.428297997 CEST60199443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:01.428297997 CEST60199443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:01.428329945 CEST4436019913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:01.428350925 CEST4436019913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:01.428904057 CEST4436020013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:01.429059029 CEST4436020013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:01.429404020 CEST60200443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:01.429788113 CEST60200443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:01.429788113 CEST60200443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:01.429853916 CEST4436020013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:01.429892063 CEST4436020013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:01.433099031 CEST60205443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:01.433145046 CEST4436020513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:01.433207989 CEST60205443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:01.433342934 CEST4436020313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:01.433490038 CEST4436020313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:01.433552980 CEST60203443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:01.433638096 CEST60205443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:01.433660984 CEST4436020513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:01.434344053 CEST60206443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:01.434353113 CEST4436020613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:01.434473991 CEST60206443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:01.434652090 CEST60206443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:01.434662104 CEST4436020613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:01.434776068 CEST60203443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:01.434776068 CEST60203443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:01.434842110 CEST4436020313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:01.434875965 CEST4436020313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:01.436355114 CEST60207443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:01.436438084 CEST4436020713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:01.436506033 CEST60207443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:01.436708927 CEST60207443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:01.436743975 CEST4436020713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:01.460856915 CEST4436020113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:01.460932016 CEST4436020113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:01.461107016 CEST60201443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:01.461184978 CEST60201443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:01.461204052 CEST4436020113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:01.461215973 CEST60201443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:01.461222887 CEST4436020113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:01.466293097 CEST60208443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:01.466376066 CEST4436020813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:01.466661930 CEST60208443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:01.466661930 CEST60208443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:01.466789007 CEST4436020813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:01.477905989 CEST4436020213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:01.478056908 CEST4436020213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:01.478123903 CEST60202443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:01.485198975 CEST60202443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:01.485213041 CEST4436020213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:01.485260963 CEST60202443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:01.485265970 CEST4436020213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:01.521783113 CEST60209443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:01.521862030 CEST4436020913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:01.521934986 CEST60209443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:01.533734083 CEST60209443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:01.533766985 CEST4436020913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.071723938 CEST4436020513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.072416067 CEST60205443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.072465897 CEST4436020513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.072925091 CEST60205443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.072978020 CEST4436020513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.073777914 CEST4436020613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.074111938 CEST60206443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.074153900 CEST4436020613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.074708939 CEST60206443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.074721098 CEST4436020613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.086852074 CEST4436020813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.087318897 CEST60208443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.087379932 CEST4436020813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.087743044 CEST60208443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.087796926 CEST4436020813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.092422009 CEST4436020713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.092796087 CEST60207443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.092854977 CEST4436020713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.093195915 CEST60207443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.093250990 CEST4436020713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.160542965 CEST4436020913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.160974026 CEST60209443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.161015987 CEST4436020913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.161488056 CEST60209443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.161499977 CEST4436020913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.166148901 CEST4436020513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.166299105 CEST4436020513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.166484118 CEST60205443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.166484118 CEST60205443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.166484118 CEST60205443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.169245958 CEST60210443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.169296980 CEST4436021013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.169379950 CEST60210443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.169529915 CEST60210443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.169544935 CEST4436021013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.172924042 CEST4436020613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.173063993 CEST4436020613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.173135042 CEST60206443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.173171997 CEST60206443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.173172951 CEST60206443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.173216105 CEST4436020613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.173243046 CEST4436020613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.175370932 CEST60211443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.175455093 CEST4436021113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.175542116 CEST60211443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.175822020 CEST60211443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.175843954 CEST4436021113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.182990074 CEST4436020813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.183132887 CEST4436020813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.183198929 CEST60208443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.183293104 CEST60208443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.183293104 CEST60208443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.183330059 CEST4436020813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.183357000 CEST4436020813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.185188055 CEST60212443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.185226917 CEST4436021213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.185297966 CEST60212443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.185444117 CEST60212443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.185461998 CEST4436021213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.195152998 CEST4436020713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.195302963 CEST4436020713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.195379019 CEST60207443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.195482016 CEST60207443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.195482969 CEST60207443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.195523977 CEST4436020713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.195552111 CEST4436020713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.197645903 CEST60213443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.197690964 CEST4436021313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.197923899 CEST60213443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.197923899 CEST60213443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.198102951 CEST4436021313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.256997108 CEST4436020913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.257143021 CEST4436020913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.257205963 CEST60209443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.257247925 CEST60209443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.257272959 CEST4436020913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.257306099 CEST60209443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.257319927 CEST4436020913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.259309053 CEST60214443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.259368896 CEST4436021413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.259434938 CEST60214443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.259533882 CEST60214443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.259550095 CEST4436021413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.470613003 CEST60205443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.470684052 CEST4436020513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.795608997 CEST4436021113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.796267033 CEST4436021213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.796360016 CEST60211443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.796439886 CEST4436021113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.796705961 CEST60212443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.796735048 CEST4436021213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.797030926 CEST60211443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.797044992 CEST4436021113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.797058105 CEST60212443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.797065020 CEST4436021213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.820847988 CEST4436021013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.821417093 CEST60210443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.821506023 CEST4436021013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.821894884 CEST60210443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.821911097 CEST4436021013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.854650974 CEST4436021313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.855217934 CEST60213443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.855262041 CEST4436021313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.855750084 CEST60213443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.855763912 CEST4436021313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.891733885 CEST4436021113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.891865969 CEST4436021113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.892031908 CEST60211443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.892107964 CEST60211443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.892107964 CEST60211443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.892149925 CEST4436021113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.892179012 CEST4436021113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.894195080 CEST4436021213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.894347906 CEST4436021213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.894424915 CEST60212443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.894602060 CEST60212443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.894614935 CEST4436021213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.894632101 CEST60212443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.894638062 CEST4436021213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.895200014 CEST60215443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.895216942 CEST4436021513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.895282030 CEST60215443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.895446062 CEST60215443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.895453930 CEST4436021513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.897054911 CEST60216443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.897102118 CEST4436021613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.897202969 CEST60216443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.897324085 CEST60216443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.897341013 CEST4436021613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.904047012 CEST4436021413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.904369116 CEST60214443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.904453039 CEST4436021413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.904911995 CEST60214443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.904925108 CEST4436021413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.916404963 CEST4436021013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.916542053 CEST4436021013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.916666031 CEST60210443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.916747093 CEST60210443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.916747093 CEST60210443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.916790009 CEST4436021013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.916819096 CEST4436021013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.918895006 CEST60217443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.918963909 CEST4436021713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.919049025 CEST60217443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.919164896 CEST60217443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.919192076 CEST4436021713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.957025051 CEST4436021313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.957166910 CEST4436021313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.957479954 CEST60213443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.957479954 CEST60213443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.957479954 CEST60213443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.959770918 CEST60218443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.959853888 CEST4436021813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:02.959949017 CEST60218443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.960040092 CEST60218443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:02.960062027 CEST4436021813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:03.003213882 CEST4436021413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:03.003380060 CEST4436021413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:03.003458977 CEST60214443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:03.003613949 CEST60214443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:03.003613949 CEST60214443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:03.003655910 CEST4436021413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:03.003684998 CEST4436021413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:03.006244898 CEST60219443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:03.006329060 CEST4436021913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:03.006419897 CEST60219443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:03.006522894 CEST60219443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:03.006541967 CEST4436021913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:03.271502018 CEST60213443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:03.271567106 CEST4436021313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:03.504657030 CEST4436021513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:03.505462885 CEST60215443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:03.505539894 CEST4436021513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:03.506293058 CEST60215443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:03.506308079 CEST4436021513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:03.510114908 CEST4436021613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:03.510574102 CEST60216443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:03.510613918 CEST4436021613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:03.511146069 CEST60216443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:03.511152983 CEST4436021613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:03.541260004 CEST4436021713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:03.541959047 CEST60217443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:03.542017937 CEST4436021713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:03.542478085 CEST60217443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:03.542531967 CEST4436021713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:03.586568117 CEST4436021813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:03.587227106 CEST60218443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:03.587310076 CEST4436021813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:03.587758064 CEST60218443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:03.587814093 CEST4436021813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:03.605591059 CEST4436021613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:03.605659962 CEST4436021613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:03.605974913 CEST60216443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:03.605974913 CEST60216443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:03.605976105 CEST60216443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:03.608772039 CEST60220443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:03.608807087 CEST4436022013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:03.608901024 CEST60220443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:03.608999968 CEST60220443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:03.609010935 CEST4436022013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:03.624008894 CEST4436021513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:03.624238968 CEST4436021513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:03.624321938 CEST60215443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:03.624402046 CEST60215443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:03.624439001 CEST4436021513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:03.624473095 CEST60215443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:03.624488115 CEST4436021513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:03.626822948 CEST60221443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:03.626907110 CEST4436022113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:03.627348900 CEST60221443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:03.627482891 CEST60221443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:03.627512932 CEST4436022113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:03.638947964 CEST4436021713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:03.639085054 CEST4436021713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:03.639161110 CEST60217443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:03.639282942 CEST60217443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:03.639282942 CEST60217443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:03.639336109 CEST4436021713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:03.639365911 CEST4436021713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:03.641092062 CEST60222443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:03.641175032 CEST4436022213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:03.642255068 CEST60222443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:03.642255068 CEST60222443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:03.642379045 CEST4436022213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:03.645716906 CEST4436021913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:03.646080017 CEST60219443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:03.646158934 CEST4436021913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:03.646687031 CEST60219443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:03.646703005 CEST4436021913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:03.684374094 CEST4436021813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:03.684530973 CEST4436021813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:03.684756041 CEST60218443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:03.684843063 CEST60218443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:03.684843063 CEST60218443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:03.684885025 CEST4436021813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:03.684919119 CEST4436021813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:03.686919928 CEST60223443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:03.686940908 CEST4436022313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:03.687021017 CEST60223443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:03.687133074 CEST60223443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:03.687139034 CEST4436022313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:03.746083021 CEST4436021913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:03.746237993 CEST4436021913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:03.746457100 CEST60219443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:03.766077042 CEST60219443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:03.766077042 CEST60219443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:03.766149998 CEST4436021913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:03.766185045 CEST4436021913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:03.770328999 CEST60224443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:03.770380020 CEST4436022413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:03.770453930 CEST60224443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:03.770692110 CEST60224443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:03.770709038 CEST4436022413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:03.914443970 CEST60216443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:03.914480925 CEST4436021613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:04.243818045 CEST4436022013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:04.244234085 CEST60220443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:04.244261026 CEST4436022013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:04.244736910 CEST60220443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:04.244745016 CEST4436022013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:04.245120049 CEST4436022113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:04.245543003 CEST60221443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:04.245605946 CEST4436022113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:04.245803118 CEST60221443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:04.245820045 CEST4436022113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:04.261049986 CEST4436022213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:04.261334896 CEST60222443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:04.261349916 CEST4436022213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:04.261724949 CEST60222443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:04.261734962 CEST4436022213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:04.299283028 CEST4436022313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:04.299592018 CEST60223443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:04.299607038 CEST4436022313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:04.299915075 CEST60223443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:04.299921036 CEST4436022313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:04.341012001 CEST4436022013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:04.341151953 CEST4436022013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:04.341207981 CEST60220443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:04.341264963 CEST60220443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:04.341284037 CEST4436022013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:04.341295004 CEST60220443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:04.341303110 CEST4436022013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:04.341636896 CEST4436022113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:04.341706038 CEST4436022113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:04.341892004 CEST60221443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:04.341892004 CEST60221443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:04.343713045 CEST60225443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:04.343713999 CEST60221443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:04.343775988 CEST4436022113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:04.343806028 CEST4436022513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:04.343847990 CEST60226443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:04.343869925 CEST4436022613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:04.343898058 CEST60225443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:04.343962908 CEST60226443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:04.344012022 CEST60225443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:04.344034910 CEST4436022513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:04.344060898 CEST60226443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:04.344072104 CEST4436022613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:04.379532099 CEST4436022213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:04.379682064 CEST4436022213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:04.379786015 CEST60222443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:04.379865885 CEST60222443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:04.379865885 CEST60222443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:04.379908085 CEST4436022213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:04.379939079 CEST4436022213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:04.381540060 CEST60227443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:04.381628990 CEST4436022713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:04.381720066 CEST60227443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:04.381818056 CEST60227443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:04.381836891 CEST4436022713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:04.392327070 CEST4436022413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:04.392595053 CEST60224443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:04.392613888 CEST4436022413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:04.392919064 CEST60224443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:04.392924070 CEST4436022413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:04.429569960 CEST4436022313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:04.429716110 CEST4436022313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:04.429899931 CEST60223443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:04.429899931 CEST60223443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:04.429899931 CEST60223443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:04.431579113 CEST60228443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:04.431598902 CEST4436022813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:04.431668997 CEST60228443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:04.431780100 CEST60228443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:04.431786060 CEST4436022813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:04.491772890 CEST4436022413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:04.491919994 CEST4436022413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:04.492053986 CEST60224443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:04.494575977 CEST60224443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:04.494601965 CEST4436022413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:04.494616985 CEST60224443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:04.494625092 CEST4436022413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:04.497118950 CEST60229443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:04.497201920 CEST4436022913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:04.497307062 CEST60229443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:04.497585058 CEST60229443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:04.497642994 CEST4436022913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:04.740101099 CEST60223443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:04.740139961 CEST4436022313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:04.966509104 CEST4436022513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:04.967122078 CEST60225443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:04.967211962 CEST4436022513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:04.967550039 CEST60225443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:04.967605114 CEST4436022513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:04.973298073 CEST4436022613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:04.973628044 CEST60226443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:04.973664999 CEST4436022613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:04.974083900 CEST60226443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:04.974138021 CEST4436022613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.020164967 CEST4436022713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.020577908 CEST60227443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.020622969 CEST4436022713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.020915985 CEST60227443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.020925045 CEST4436022713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.066668034 CEST4436022513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.066732883 CEST4436022513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.066921949 CEST60225443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.066921949 CEST60225443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.067995071 CEST60225443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.068057060 CEST4436022513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.069608927 CEST60230443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.069690943 CEST4436023013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.069770098 CEST60230443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.069885015 CEST60230443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.069917917 CEST4436023013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.070760965 CEST4436022613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.070911884 CEST4436022613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.071089983 CEST60226443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.071089983 CEST60226443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.071089983 CEST60226443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.072513103 CEST60231443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.072546959 CEST4436023113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.072612047 CEST60231443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.072705030 CEST60231443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.072711945 CEST4436023113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.086371899 CEST4436022813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.086677074 CEST60228443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.086692095 CEST4436022813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.087014914 CEST60228443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.087019920 CEST4436022813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.120894909 CEST4436022713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.121040106 CEST4436022713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.121196032 CEST60227443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.121196032 CEST60227443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.121196032 CEST60227443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.122881889 CEST4436022913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.122901917 CEST60232443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.122987986 CEST4436023213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.123060942 CEST60232443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.123265982 CEST60229443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.123325109 CEST4436022913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.123492956 CEST60232443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.123570919 CEST4436023213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.123595953 CEST60229443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.123648882 CEST4436022913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.188848972 CEST4436022813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.188982010 CEST4436022813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.189045906 CEST60228443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.189150095 CEST60228443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.189172983 CEST4436022813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.189186096 CEST60228443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.189196110 CEST4436022813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.191452026 CEST60233443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.191548109 CEST4436023313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.191636086 CEST60233443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.191776991 CEST60233443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.191795111 CEST4436023313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.221774101 CEST4436022913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.221925974 CEST4436022913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.222003937 CEST60229443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.222070932 CEST60229443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.222071886 CEST60229443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.222103119 CEST4436022913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.222130060 CEST4436022913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.223913908 CEST60234443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.223938942 CEST4436023413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.224009037 CEST60234443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.224108934 CEST60234443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.224127054 CEST4436023413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.382930994 CEST60226443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.382993937 CEST4436022613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.430531025 CEST60227443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.430565119 CEST4436022713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.648531914 CEST60235443192.168.2.4142.250.185.132
                                                        Oct 7, 2024 20:47:05.648581028 CEST44360235142.250.185.132192.168.2.4
                                                        Oct 7, 2024 20:47:05.648689985 CEST60235443192.168.2.4142.250.185.132
                                                        Oct 7, 2024 20:47:05.648880005 CEST60235443192.168.2.4142.250.185.132
                                                        Oct 7, 2024 20:47:05.648891926 CEST44360235142.250.185.132192.168.2.4
                                                        Oct 7, 2024 20:47:05.695580959 CEST4436023013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.696321964 CEST60230443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.696410894 CEST4436023013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.696672916 CEST60230443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.696726084 CEST4436023013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.713056087 CEST4436023113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.713443995 CEST60231443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.713459969 CEST4436023113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.713932037 CEST60231443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.713937044 CEST4436023113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.732122898 CEST4436023213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.732592106 CEST60232443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.732673883 CEST4436023213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.732886076 CEST60232443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.732901096 CEST4436023213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.791241884 CEST4436023013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.791415930 CEST4436023013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.791518927 CEST60230443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.791520119 CEST60230443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.791596889 CEST60230443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.791634083 CEST4436023013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.793950081 CEST60236443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.794032097 CEST4436023613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.794132948 CEST60236443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.794275045 CEST60236443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.794294119 CEST4436023613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.813560009 CEST4436023113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.813709974 CEST4436023113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.814659119 CEST60231443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.815035105 CEST60231443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.815048933 CEST4436023113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.815057039 CEST60231443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.815061092 CEST4436023113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.815128088 CEST4436023313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.817008972 CEST60237443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.817095041 CEST4436023713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.817177057 CEST60237443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.817249060 CEST60237443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.817266941 CEST4436023713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.817308903 CEST60233443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.817358971 CEST4436023313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.817850113 CEST60233443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.817864895 CEST4436023313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.842981100 CEST4436023213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.843132973 CEST4436023213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.843328953 CEST60232443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.843413115 CEST60232443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.843413115 CEST60232443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.843455076 CEST4436023213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.843485117 CEST4436023213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.845576048 CEST60238443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.845599890 CEST4436023813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.845669031 CEST60238443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.846025944 CEST60238443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.846054077 CEST4436023813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.882272959 CEST4436023413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.883217096 CEST60234443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.883251905 CEST4436023413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.883622885 CEST60234443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.883634090 CEST4436023413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.911602020 CEST4436023313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.911747932 CEST4436023313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.911829948 CEST60233443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.911977053 CEST60233443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.912009001 CEST4436023313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.912034988 CEST60233443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.912051916 CEST4436023313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.914153099 CEST60239443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.914237022 CEST4436023913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.914326906 CEST60239443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.914439917 CEST60239443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.914458990 CEST4436023913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.981040001 CEST4436023413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.981190920 CEST4436023413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.981457949 CEST60234443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.981457949 CEST60234443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.981457949 CEST60234443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.983081102 CEST60240443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.983164072 CEST4436024013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:05.983282089 CEST60240443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.983365059 CEST60240443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:05.983387947 CEST4436024013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:06.269555092 CEST44360235142.250.185.132192.168.2.4
                                                        Oct 7, 2024 20:47:06.270036936 CEST60235443192.168.2.4142.250.185.132
                                                        Oct 7, 2024 20:47:06.270081997 CEST44360235142.250.185.132192.168.2.4
                                                        Oct 7, 2024 20:47:06.271584988 CEST44360235142.250.185.132192.168.2.4
                                                        Oct 7, 2024 20:47:06.272011995 CEST60235443192.168.2.4142.250.185.132
                                                        Oct 7, 2024 20:47:06.272424936 CEST44360235142.250.185.132192.168.2.4
                                                        Oct 7, 2024 20:47:06.287455082 CEST60234443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:06.287525892 CEST4436023413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:06.318053007 CEST60235443192.168.2.4142.250.185.132
                                                        Oct 7, 2024 20:47:06.433738947 CEST4436023613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:06.434432030 CEST60236443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:06.434551001 CEST4436023613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:06.435018063 CEST60236443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:06.435070992 CEST4436023613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:06.441312075 CEST4436023713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:06.483264923 CEST4436023813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:06.490145922 CEST60237443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:06.495584965 CEST60237443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:06.495614052 CEST4436023713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:06.496361971 CEST60237443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:06.496372938 CEST4436023713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:06.497348070 CEST60238443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:06.497363091 CEST4436023813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:06.497889996 CEST60238443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:06.497900009 CEST4436023813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:06.532165051 CEST4436023613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:06.532305956 CEST4436023613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:06.532453060 CEST60236443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:06.532737970 CEST60236443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:06.532783985 CEST4436023613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:06.532847881 CEST60236443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:06.532862902 CEST4436023613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:06.545595884 CEST60241443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:06.545636892 CEST4436024113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:06.545737982 CEST60241443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:06.545842886 CEST60241443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:06.545849085 CEST4436024113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:06.553513050 CEST4436023913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:06.554629087 CEST60239443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:06.554687023 CEST4436023913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:06.557385921 CEST60239443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:06.557439089 CEST4436023913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:06.588538885 CEST4436023713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:06.588690996 CEST4436023713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:06.588778973 CEST60237443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:06.590497017 CEST60237443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:06.590497017 CEST60237443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:06.590532064 CEST4436023713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:06.590553999 CEST4436023713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:06.593766928 CEST4436023813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:06.593939066 CEST4436023813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:06.594007969 CEST60238443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:06.603323936 CEST60238443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:06.603324890 CEST60238443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:06.603338957 CEST4436023813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:06.603358984 CEST4436023813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:06.605696917 CEST60242443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:06.605711937 CEST4436024213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:06.605801105 CEST60242443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:06.606034994 CEST60242443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:06.606046915 CEST4436024213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:06.606626034 CEST60243443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:06.606709957 CEST4436024313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:06.606868982 CEST60243443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:06.606966972 CEST60243443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:06.606987953 CEST4436024313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:06.607104063 CEST4436024013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:06.607341051 CEST60240443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:06.607373953 CEST4436024013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:06.607671022 CEST60240443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:06.607682943 CEST4436024013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:06.653678894 CEST4436023913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:06.653825998 CEST4436023913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:06.654129028 CEST60239443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:06.654129028 CEST60239443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:06.654129028 CEST60239443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:06.656794071 CEST60244443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:06.656877995 CEST4436024413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:06.656985044 CEST60244443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:06.657109976 CEST60244443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:06.657133102 CEST4436024413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:06.704114914 CEST4436024013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:06.704255104 CEST4436024013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:06.704495907 CEST60240443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:06.704495907 CEST60240443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:06.704497099 CEST60240443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:06.706145048 CEST60245443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:06.706242085 CEST4436024513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:06.706945896 CEST60245443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:06.707026005 CEST60245443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:06.707045078 CEST4436024513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:06.959037066 CEST60239443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:06.959098101 CEST4436023913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:07.005759954 CEST60240443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:07.005820990 CEST4436024013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:07.188251019 CEST4436024213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:07.189167023 CEST60242443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:07.189199924 CEST4436024213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:07.189619064 CEST60242443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:07.189627886 CEST4436024213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:07.234204054 CEST4436024113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:07.234601021 CEST60241443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:07.234613895 CEST4436024113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:07.234966993 CEST60241443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:07.234972954 CEST4436024113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:07.269728899 CEST4436024313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:07.270220995 CEST60243443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:07.270302057 CEST4436024313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:07.270595074 CEST60243443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:07.270648003 CEST4436024313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:07.279731989 CEST4436024413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:07.280122995 CEST60244443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:07.280205965 CEST4436024413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:07.280462027 CEST60244443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:07.280517101 CEST4436024413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:07.288167000 CEST4436024213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:07.288316011 CEST4436024213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:07.288377047 CEST60242443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:07.288537979 CEST60242443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:07.288557053 CEST4436024213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:07.288568974 CEST60242443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:07.288575888 CEST4436024213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:07.291996002 CEST60246443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:07.292045116 CEST4436024613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:07.292120934 CEST60246443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:07.292237043 CEST60246443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:07.292254925 CEST4436024613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:07.336985111 CEST4436024113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:07.337050915 CEST4436024113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:07.337090969 CEST60241443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:07.337754011 CEST60241443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:07.337771893 CEST4436024113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:07.337784052 CEST60241443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:07.337790012 CEST4436024113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:07.342911959 CEST60247443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:07.342997074 CEST4436024713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:07.343086004 CEST60247443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:07.343369007 CEST60247443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:07.343452930 CEST4436024713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:07.362931967 CEST4436024313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:07.363070965 CEST4436024313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:07.363164902 CEST60243443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:07.363164902 CEST60243443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:07.363164902 CEST60243443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:07.365128040 CEST60248443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:07.365216970 CEST4436024813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:07.365283966 CEST60248443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:07.365438938 CEST60248443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:07.365458012 CEST4436024813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:07.385421991 CEST4436024413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:07.385565042 CEST4436024413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:07.385664940 CEST4436024513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:07.385668039 CEST60244443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:07.385668039 CEST60244443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:07.385668039 CEST60244443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:07.386481047 CEST60245443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:07.386539936 CEST4436024513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:07.386879921 CEST60245443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:07.386893988 CEST4436024513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:07.387470007 CEST60249443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:07.387552977 CEST4436024913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:07.387620926 CEST60249443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:07.387772083 CEST60249443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:07.387805939 CEST4436024913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:07.495917082 CEST4436024513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:07.496078014 CEST4436024513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:07.496248007 CEST60245443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:07.496248007 CEST60245443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:07.496248007 CEST60245443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:07.498020887 CEST60250443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:07.498104095 CEST4436025013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:07.498188972 CEST60250443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:07.498270035 CEST60250443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:07.498290062 CEST4436025013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:07.521487951 CEST4972480192.168.2.493.184.221.240
                                                        Oct 7, 2024 20:47:07.527911901 CEST804972493.184.221.240192.168.2.4
                                                        Oct 7, 2024 20:47:07.528141975 CEST4972480192.168.2.493.184.221.240
                                                        Oct 7, 2024 20:47:07.677705050 CEST60243443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:07.677767992 CEST4436024313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:07.687664032 CEST60244443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:07.687731028 CEST4436024413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:07.803637981 CEST60245443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:07.803672075 CEST4436024513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:07.973752022 CEST4436024613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:07.974220991 CEST60246443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:07.974282026 CEST4436024613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:07.974651098 CEST60246443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:07.974663973 CEST4436024613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.002713919 CEST4436024713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.003384113 CEST60247443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.003470898 CEST4436024713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.003881931 CEST60247443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.003935099 CEST4436024713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.010483980 CEST4436024813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.012271881 CEST60248443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.012356997 CEST4436024813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.012931108 CEST60248443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.012943983 CEST4436024813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.073762894 CEST4436024913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.074379921 CEST60249443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.074448109 CEST4436024913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.074727058 CEST60249443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.074779987 CEST4436024913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.080585003 CEST4436024613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.080636978 CEST4436024613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.080728054 CEST60246443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.080761909 CEST4436024613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.080790043 CEST4436024613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.080841064 CEST60246443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.080873013 CEST60246443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.080873013 CEST60246443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.080890894 CEST4436024613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.080902100 CEST4436024613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.083285093 CEST60251443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.083348989 CEST4436025113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.083427906 CEST60251443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.083547115 CEST60251443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.083561897 CEST4436025113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.101330996 CEST4436024713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.101475954 CEST4436024713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.101666927 CEST60247443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.101753950 CEST60247443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.101753950 CEST60247443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.101797104 CEST4436024713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.101831913 CEST4436024713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.103430986 CEST60252443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.103518009 CEST4436025213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.103602886 CEST60252443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.103697062 CEST60252443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.103714943 CEST4436025213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.105408907 CEST4436024813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.106015921 CEST4436024813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.106084108 CEST60248443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.106126070 CEST60248443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.106126070 CEST60248443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.106147051 CEST4436024813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.106168985 CEST4436024813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.107722998 CEST60253443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.107806921 CEST4436025313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.107892036 CEST60253443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.107991934 CEST60253443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.108014107 CEST4436025313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.169109106 CEST4436025013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.169539928 CEST60250443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.169598103 CEST4436025013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.169898033 CEST60250443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.169950962 CEST4436025013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.170893908 CEST4436024913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.170960903 CEST4436024913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.171086073 CEST4436024913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.171127081 CEST60249443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.171196938 CEST60249443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.171196938 CEST60249443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.171197891 CEST60249443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.172888041 CEST60254443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.172967911 CEST4436025413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.173067093 CEST60254443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.173172951 CEST60254443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.173192978 CEST4436025413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.269464970 CEST4436025013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.269520044 CEST4436025013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.269644022 CEST4436025013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.269728899 CEST60250443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.269730091 CEST60250443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.269817114 CEST60250443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.269817114 CEST60250443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.269856930 CEST4436025013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.269891024 CEST4436025013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.272525072 CEST60255443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.272597075 CEST4436025513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.272659063 CEST60255443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.272797108 CEST60255443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.272819042 CEST4436025513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.474163055 CEST60249443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.474225044 CEST4436024913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.901807070 CEST4436025113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.902647018 CEST60251443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.902729034 CEST4436025113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.903058052 CEST60251443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.903074980 CEST4436025113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.904863119 CEST4436025313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.905190945 CEST4436025213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.905288935 CEST60253443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.905366898 CEST4436025313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.905441046 CEST60252443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.905467987 CEST60253443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.905494928 CEST4436025313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.905514956 CEST4436025213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.905884981 CEST60252443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.905896902 CEST4436025213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.997293949 CEST4436025113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.997349024 CEST4436025113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.997427940 CEST60251443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.997453928 CEST4436025113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.997483969 CEST4436025113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.998708963 CEST60251443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.998708963 CEST60251443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.998759985 CEST4436025113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:08.998790026 CEST60251443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:08.998806000 CEST4436025113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.000979900 CEST4436025213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.001126051 CEST4436025213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.001199961 CEST60252443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.004026890 CEST4436025313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.004407883 CEST4436025313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.004515886 CEST60253443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.009496927 CEST60252443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.009531975 CEST4436025213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.009557962 CEST60252443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.009572029 CEST4436025213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.012417078 CEST60253443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.012417078 CEST60253443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.012481928 CEST4436025313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.012516975 CEST4436025313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.044254065 CEST60256443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.044307947 CEST4436025613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.044394970 CEST60256443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.047724009 CEST60256443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.047750950 CEST4436025613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.053889990 CEST60257443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.053972960 CEST4436025713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.054081917 CEST60257443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.057343006 CEST60257443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.057418108 CEST4436025713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.060635090 CEST60258443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.060717106 CEST4436025813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.060800076 CEST60258443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.063802004 CEST60258443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.063834906 CEST4436025813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.085597992 CEST4436025413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.085611105 CEST4436025513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.092684984 CEST60254443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.092762947 CEST4436025413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.093177080 CEST60254443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.093230009 CEST4436025413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.093419075 CEST60255443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.093446970 CEST4436025513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.093724012 CEST60255443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.093734026 CEST4436025513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.185358047 CEST4436025513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.185930967 CEST4436025513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.186017036 CEST60255443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.186155081 CEST60255443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.186155081 CEST60255443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.186182976 CEST4436025513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.186203003 CEST4436025513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.187438965 CEST4436025413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.187597990 CEST4436025413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.187810898 CEST60254443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.187812090 CEST60254443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.187812090 CEST60254443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.189317942 CEST60259443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.189352036 CEST4436025913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.189415932 CEST60259443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.189728022 CEST60259443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.189754009 CEST4436025913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.189893961 CEST60260443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.189965010 CEST4436026013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.190031052 CEST60260443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.190125942 CEST60260443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.190140963 CEST4436026013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.489729881 CEST60254443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.489789963 CEST4436025413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.694797993 CEST4436025613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.695332050 CEST60256443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.695424080 CEST4436025613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.695780039 CEST60256443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.695792913 CEST4436025613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.700469017 CEST4436025813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.701205969 CEST60258443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.701262951 CEST4436025813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.701565027 CEST60258443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.701617956 CEST4436025813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.713469028 CEST4436025713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.713810921 CEST60257443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.713867903 CEST4436025713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.714164019 CEST60257443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.714178085 CEST4436025713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.812323093 CEST4436025813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.812585115 CEST4436025813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.812808990 CEST60258443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.812808990 CEST60258443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.812808990 CEST60258443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.815232992 CEST60261443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.815315008 CEST4436026113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.815438032 CEST60261443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.815558910 CEST60261443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.815578938 CEST4436026113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.819972038 CEST4436025713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.820116043 CEST4436025713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.820203066 CEST60257443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.820291042 CEST60257443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.820291042 CEST60257443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.820332050 CEST4436025713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.820362091 CEST4436025713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.822210073 CEST60262443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.822292089 CEST4436026213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.822370052 CEST60262443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.822475910 CEST60262443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.822494984 CEST4436026213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.835046053 CEST4436025913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.835422039 CEST60259443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.835443974 CEST4436025913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.835813046 CEST60259443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.835823059 CEST4436025913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.859658957 CEST4436026013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.859991074 CEST60260443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.860033035 CEST4436026013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.860321999 CEST60260443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.860333920 CEST4436026013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.931210995 CEST4436025913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.931750059 CEST4436025913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.931827068 CEST60259443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.931880951 CEST60259443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.931880951 CEST60259443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.931915045 CEST4436025913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.931935072 CEST4436025913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.933861017 CEST60263443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.933923006 CEST4436026313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.934010983 CEST60263443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.934129000 CEST60263443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.934144020 CEST4436026313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.944271088 CEST4436025613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.944417953 CEST4436025613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.944489002 CEST60256443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.944602966 CEST60256443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.944602966 CEST60256443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.944645882 CEST4436025613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.944659948 CEST4436025613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.946297884 CEST60264443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.946382999 CEST4436026413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.946468115 CEST60264443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.946562052 CEST60264443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.946584940 CEST4436026413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.957123995 CEST4436026013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.957264900 CEST4436026013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.957333088 CEST60260443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.957379103 CEST60260443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.957380056 CEST60260443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.957402945 CEST4436026013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.957425117 CEST4436026013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.959172964 CEST60265443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.959211111 CEST4436026513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:09.959279060 CEST60265443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.959618092 CEST60265443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:09.959634066 CEST4436026513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:10.115216017 CEST60258443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:10.115277052 CEST4436025813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:10.453453064 CEST4436026213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:10.453964949 CEST60262443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:10.454042912 CEST4436026213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:10.454375029 CEST60262443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:10.454389095 CEST4436026213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:10.454684973 CEST4436026113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:10.454916000 CEST60261443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:10.454941988 CEST4436026113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:10.455178976 CEST60261443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:10.455188990 CEST4436026113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:10.548882961 CEST4436026213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:10.548968077 CEST4436026213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:10.549074888 CEST4436026213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:10.549201012 CEST60262443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:10.549201012 CEST60262443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:10.549527884 CEST60262443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:10.549529076 CEST60262443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:10.549593925 CEST4436026213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:10.549631119 CEST4436026213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:10.550808907 CEST4436026113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:10.550986052 CEST4436026113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:10.551178932 CEST60261443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:10.551178932 CEST60261443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:10.551178932 CEST60261443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:10.552808046 CEST60266443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:10.552886963 CEST4436026613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:10.552977085 CEST60266443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:10.553126097 CEST60266443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:10.553143024 CEST4436026613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:10.553225994 CEST60267443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:10.553288937 CEST4436026713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:10.553376913 CEST60267443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:10.553452015 CEST60267443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:10.553471088 CEST4436026713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:10.581994057 CEST4436026513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:10.582608938 CEST60265443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:10.582686901 CEST4436026513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:10.582961082 CEST60265443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:10.582974911 CEST4436026513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:10.585441113 CEST4436026313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:10.585766077 CEST60263443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:10.585845947 CEST4436026313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:10.586097956 CEST60263443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:10.586112976 CEST4436026313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:10.591730118 CEST4436026413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:10.592152119 CEST60264443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:10.592242956 CEST4436026413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:10.592343092 CEST60264443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:10.592372894 CEST4436026413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:10.687984943 CEST4436026513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:10.688142061 CEST4436026513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:10.688222885 CEST60265443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:10.688339949 CEST60265443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:10.688380003 CEST4436026513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:10.688405991 CEST60265443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:10.688422918 CEST4436026513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:10.689264059 CEST4436026313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:10.689280033 CEST4436026413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:10.689414978 CEST4436026313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:10.689604044 CEST60263443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:10.689604044 CEST60263443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:10.689604044 CEST60263443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:10.689671993 CEST4436026413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:10.689778090 CEST4436026413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:10.689855099 CEST60264443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:10.689855099 CEST60264443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:10.689946890 CEST60264443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:10.689985991 CEST4436026413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:10.690042019 CEST60264443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:10.690058947 CEST4436026413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:10.691138029 CEST60268443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:10.691198111 CEST4436026813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:10.691299915 CEST60268443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:10.691448927 CEST60268443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:10.691466093 CEST4436026813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:10.691987991 CEST60269443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:10.692035913 CEST4436026913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:10.692082882 CEST60270443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:10.692095995 CEST4436027013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:10.692110062 CEST60269443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:10.692137957 CEST60270443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:10.692181110 CEST60269443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:10.692198038 CEST4436026913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:10.692310095 CEST60270443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:10.692326069 CEST4436027013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:10.864897966 CEST60261443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:10.864959002 CEST4436026113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:10.991079092 CEST60263443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:10.991143942 CEST4436026313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:11.180274010 CEST4436026713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:11.180880070 CEST60267443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:11.180953026 CEST4436026713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:11.181204081 CEST60267443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:11.181222916 CEST4436026713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:11.191517115 CEST4436026613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:11.191876888 CEST60266443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:11.191962957 CEST4436026613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:11.192248106 CEST60266443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:11.192265987 CEST4436026613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:11.277426004 CEST4436026713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:11.277561903 CEST4436026713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:11.277623892 CEST60267443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:11.277733088 CEST60267443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:11.277734041 CEST60267443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:11.277762890 CEST4436026713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:11.277786970 CEST4436026713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:11.280383110 CEST60271443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:11.280424118 CEST4436027113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:11.280636072 CEST60271443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:11.280636072 CEST60271443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:11.280706882 CEST4436027113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:11.294152021 CEST4436026613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:11.294296026 CEST4436026613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:11.294363022 CEST60266443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:11.294442892 CEST60266443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:11.294442892 CEST60266443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:11.294478893 CEST4436026613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:11.294502974 CEST4436026613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:11.296571016 CEST60272443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:11.296653032 CEST4436027213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:11.296726942 CEST60272443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:11.296821117 CEST60272443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:11.296839952 CEST4436027213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:11.334244013 CEST4436026813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:11.334769011 CEST4436027013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:11.335290909 CEST60270443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:11.335297108 CEST60268443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:11.335303068 CEST4436027013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:11.335334063 CEST4436026813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:11.335752010 CEST60270443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:11.335756063 CEST4436027013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:11.335802078 CEST60268443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:11.335829020 CEST4436026813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:11.380017996 CEST4436026913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:11.380503893 CEST60269443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:11.380516052 CEST4436026913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:11.380729914 CEST60269443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:11.380733967 CEST4436026913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:11.448080063 CEST4436027013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:11.448257923 CEST4436027013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:11.448421001 CEST60270443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:11.448421001 CEST60270443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:11.448421001 CEST60270443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:11.450073004 CEST60273443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:11.450141907 CEST4436027313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:11.450234890 CEST60273443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:11.450335026 CEST60273443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:11.450351000 CEST4436027313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:11.451489925 CEST4436026813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:11.451564074 CEST4436026813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:11.451622963 CEST60268443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:11.451684952 CEST4436026813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:11.451719999 CEST4436026813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:11.451767921 CEST60268443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:11.451814890 CEST60268443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:11.451814890 CEST60268443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:11.451847076 CEST4436026813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:11.451870918 CEST4436026813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:11.453389883 CEST60274443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:11.453413010 CEST4436027413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:11.453485012 CEST60274443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:11.453578949 CEST60274443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:11.453588963 CEST4436027413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:11.548980951 CEST4436026913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:11.549129009 CEST4436026913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:11.549181938 CEST60269443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:11.549299955 CEST60269443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:11.549316883 CEST4436026913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:11.549324989 CEST60269443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:11.549338102 CEST4436026913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:11.551933050 CEST60275443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:11.552015066 CEST4436027513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:11.552109957 CEST60275443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:11.552246094 CEST60275443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:11.552268982 CEST4436027513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:11.755918980 CEST60270443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:11.755935907 CEST4436027013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:11.906847000 CEST4436027213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:11.907558918 CEST60272443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:11.907634974 CEST4436027213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:11.907897949 CEST60272443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:11.907912016 CEST4436027213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.004602909 CEST4436027213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.005590916 CEST4436027213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.005717993 CEST4436027213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.006000042 CEST60272443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.006000042 CEST60272443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.006000042 CEST60272443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.006095886 CEST60272443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.006131887 CEST4436027213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.011950970 CEST60276443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.012033939 CEST4436027613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.012234926 CEST60276443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.012480974 CEST60276443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.012501001 CEST4436027613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.073873997 CEST4436027313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.074368000 CEST60273443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.074440956 CEST4436027313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.074707031 CEST60273443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.074719906 CEST4436027313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.092679977 CEST4436027413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.092946053 CEST60274443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.092967987 CEST4436027413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.093379974 CEST60274443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.093390942 CEST4436027413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.166428089 CEST4436027513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.167083979 CEST60275443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.167165041 CEST4436027513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.167458057 CEST60275443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.167474985 CEST4436027513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.172717094 CEST4436027313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.172851086 CEST4436027313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.172930956 CEST60273443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.173121929 CEST60273443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.173177004 CEST4436027313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.173216105 CEST60273443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.173230886 CEST4436027313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.176363945 CEST60277443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.176456928 CEST4436027713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.176565886 CEST60277443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.176794052 CEST60277443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.176816940 CEST4436027713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.214891911 CEST4436027413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.214966059 CEST4436027413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.215018034 CEST60274443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.215039968 CEST4436027413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.215079069 CEST4436027413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.215126991 CEST60274443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.215188026 CEST60274443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.215207100 CEST4436027413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.215229034 CEST60274443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.215240002 CEST4436027413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.217267036 CEST60278443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.217293978 CEST4436027813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.217499971 CEST60278443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.217499971 CEST60278443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.217554092 CEST4436027813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.261924982 CEST4436027513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.263195992 CEST4436027513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.263375044 CEST60275443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.263375044 CEST60275443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.263375044 CEST60275443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.265414000 CEST60279443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.265497923 CEST4436027913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.265572071 CEST60279443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.265866995 CEST60279443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.265944958 CEST4436027913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.568499088 CEST60275443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.568561077 CEST4436027513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.641489029 CEST4436027613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.642241001 CEST60276443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.642298937 CEST4436027613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.642554045 CEST60276443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.642570019 CEST4436027613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.736983061 CEST4436027613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.737123966 CEST4436027613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.737299919 CEST60276443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.737382889 CEST60276443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.737382889 CEST60276443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.737426043 CEST4436027613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.737457037 CEST4436027613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.740268946 CEST60281443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.740336895 CEST4436028113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.740415096 CEST60281443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.740586042 CEST60281443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.740614891 CEST4436028113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.825536966 CEST4436027713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.825932980 CEST60277443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.825963020 CEST4436027713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.826370001 CEST60277443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.826375961 CEST4436027713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.844563961 CEST4436027813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.844985962 CEST60278443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.844995022 CEST4436027813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.845266104 CEST60278443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.845272064 CEST4436027813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.894862890 CEST4436027913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.895427942 CEST60279443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.895509005 CEST4436027913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.895831108 CEST60279443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.895884037 CEST4436027913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.926457882 CEST4436027713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.926606894 CEST4436027713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.926858902 CEST60277443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.927074909 CEST60277443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.927076101 CEST60277443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.927110910 CEST4436027713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.927139044 CEST4436027713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.929805994 CEST60282443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.929888964 CEST4436028213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.930157900 CEST60282443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.930157900 CEST60282443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.930288076 CEST4436028213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.938754082 CEST4436027813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.938824892 CEST4436027813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.938934088 CEST4436027813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.938971996 CEST60278443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.939157963 CEST60278443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.939270020 CEST60278443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.939270973 CEST60278443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.939296007 CEST4436027813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.939317942 CEST4436027813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.941251040 CEST60283443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.941299915 CEST4436028313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.941375971 CEST60283443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.941494942 CEST60283443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.941504002 CEST4436028313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.995723009 CEST4436027913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.995876074 CEST4436027913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.996170998 CEST60279443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.996170998 CEST60279443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.996170998 CEST60279443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.998090029 CEST60284443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.998162985 CEST4436028413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:12.998230934 CEST60284443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.998326063 CEST60284443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:12.998342037 CEST4436028413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:13.302886963 CEST60279443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:13.302947998 CEST4436027913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:13.354743004 CEST4436028113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:13.355267048 CEST60281443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:13.355343103 CEST4436028113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:13.355716944 CEST60281443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:13.355730057 CEST4436028113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:13.453846931 CEST4436028113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:13.453995943 CEST4436028113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:13.454190016 CEST60281443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:13.460040092 CEST60281443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:13.460040092 CEST60281443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:13.460089922 CEST4436028113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:13.460124016 CEST4436028113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:13.467309952 CEST60285443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:13.467396021 CEST4436028513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:13.467514992 CEST60285443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:13.467843056 CEST60285443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:13.467916965 CEST4436028513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:13.545746088 CEST4436028213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:13.578881025 CEST60282443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:13.578938961 CEST4436028213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:13.579195976 CEST60282443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:13.579214096 CEST4436028213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:13.579680920 CEST4436028313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:13.579942942 CEST60283443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:13.579957962 CEST4436028313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:13.580270052 CEST60283443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:13.580277920 CEST4436028313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:13.612217903 CEST4436028413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:13.615046978 CEST60284443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:13.615083933 CEST4436028413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:13.621041059 CEST60284443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:13.621059895 CEST4436028413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:13.671129942 CEST4436028213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:13.671287060 CEST4436028213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:13.671374083 CEST60282443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:13.671479940 CEST60282443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:13.671479940 CEST60282443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:13.671508074 CEST4436028213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:13.671531916 CEST4436028213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:13.674021006 CEST60286443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:13.674104929 CEST4436028613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:13.674215078 CEST60286443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:13.674309969 CEST60286443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:13.674334049 CEST4436028613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:13.674856901 CEST4436028313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:13.675048113 CEST4436028313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:13.675106049 CEST60283443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:13.675123930 CEST4436028313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:13.675148010 CEST4436028313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:13.675189018 CEST60283443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:13.675209999 CEST60283443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:13.675228119 CEST4436028313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:13.675239086 CEST60283443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:13.675245047 CEST4436028313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:13.677007914 CEST60287443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:13.677043915 CEST4436028713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:13.677110910 CEST60287443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:13.677215099 CEST60287443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:13.677221060 CEST4436028713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:13.711941004 CEST4436028413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:13.712122917 CEST4436028413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:13.712215900 CEST60284443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:13.712239981 CEST60284443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:13.712253094 CEST4436028413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:13.712264061 CEST60284443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:13.712270021 CEST4436028413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:13.713912010 CEST60288443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:13.713968992 CEST4436028813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:13.714045048 CEST60288443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:13.714154959 CEST60288443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:13.714168072 CEST4436028813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:14.174221992 CEST60289443192.168.2.4142.250.186.78
                                                        Oct 7, 2024 20:47:14.174263000 CEST44360289142.250.186.78192.168.2.4
                                                        Oct 7, 2024 20:47:14.174324989 CEST60289443192.168.2.4142.250.186.78
                                                        Oct 7, 2024 20:47:14.174545050 CEST60289443192.168.2.4142.250.186.78
                                                        Oct 7, 2024 20:47:14.174561977 CEST44360289142.250.186.78192.168.2.4
                                                        Oct 7, 2024 20:47:14.180565119 CEST60290443192.168.2.4142.250.186.78
                                                        Oct 7, 2024 20:47:14.180593014 CEST44360290142.250.186.78192.168.2.4
                                                        Oct 7, 2024 20:47:14.180655003 CEST60290443192.168.2.4142.250.186.78
                                                        Oct 7, 2024 20:47:14.180875063 CEST60290443192.168.2.4142.250.186.78
                                                        Oct 7, 2024 20:47:14.180902004 CEST44360290142.250.186.78192.168.2.4
                                                        Oct 7, 2024 20:47:14.274760008 CEST4436027113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:14.275365114 CEST60271443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:14.275434017 CEST4436027113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:14.275799990 CEST60271443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:14.275815010 CEST4436027113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:14.288870096 CEST4436028613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:14.289272070 CEST60286443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:14.289352894 CEST4436028613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:14.289661884 CEST60286443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:14.289676905 CEST4436028613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:14.341948986 CEST4436028713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:14.342304945 CEST60287443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:14.342363119 CEST4436028713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:14.342770100 CEST60287443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:14.342781067 CEST4436028713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:14.359508038 CEST4436028813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:14.359808922 CEST60288443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:14.359850883 CEST4436028813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:14.360150099 CEST60288443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:14.360165119 CEST4436028813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:14.386991024 CEST4436028613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:14.387144089 CEST4436028613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:14.387161970 CEST4436027113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:14.387218952 CEST60286443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:14.387418032 CEST60286443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:14.387418985 CEST60286443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:14.387449026 CEST4436028613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:14.387476921 CEST4436028613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:14.387553930 CEST4436027113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:14.387620926 CEST60271443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:14.387682915 CEST60271443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:14.387684107 CEST60271443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:14.387711048 CEST4436027113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:14.387732983 CEST4436027113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:14.390204906 CEST60291443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:14.390259027 CEST60292443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:14.390266895 CEST4436029113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:14.390341043 CEST60291443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:14.390347958 CEST4436029213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:14.390415907 CEST60292443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:14.390484095 CEST60291443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:14.390497923 CEST4436029113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:14.390530109 CEST60292443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:14.390547991 CEST4436029213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:14.432734013 CEST4436028513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:14.433145046 CEST60285443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:14.433227062 CEST4436028513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:14.433497906 CEST60285443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:14.433552980 CEST4436028513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:14.440243006 CEST4436028713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:14.440310955 CEST4436028713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:14.440398932 CEST60287443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:14.440408945 CEST4436028713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:14.440466881 CEST60287443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:14.440512896 CEST60287443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:14.440512896 CEST60287443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:14.440552950 CEST4436028713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:14.440582991 CEST4436028713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:14.442363024 CEST60293443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:14.442445993 CEST4436029313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:14.442559958 CEST60293443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:14.442651033 CEST60293443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:14.442673922 CEST4436029313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:14.457847118 CEST4436028813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:14.458000898 CEST4436028813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:14.458173990 CEST60288443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:14.458237886 CEST60288443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:14.458239079 CEST60288443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:14.458265066 CEST4436028813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:14.458287954 CEST4436028813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:14.460056067 CEST60294443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:14.460139990 CEST4436029413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:14.460397959 CEST60294443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:14.460398912 CEST60294443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:14.460530043 CEST4436029413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:14.532931089 CEST4436028513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:14.533216953 CEST4436028513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:14.533396006 CEST60285443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:14.533565044 CEST60285443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:14.533565044 CEST60285443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:14.533607960 CEST4436028513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:14.533638000 CEST4436028513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:14.535491943 CEST60295443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:14.535573006 CEST4436029513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:14.535655022 CEST60295443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:14.535768032 CEST60295443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:14.535784960 CEST4436029513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:14.779376030 CEST44360289142.250.186.78192.168.2.4
                                                        Oct 7, 2024 20:47:14.779797077 CEST60289443192.168.2.4142.250.186.78
                                                        Oct 7, 2024 20:47:14.779839993 CEST44360289142.250.186.78192.168.2.4
                                                        Oct 7, 2024 20:47:14.781095028 CEST44360289142.250.186.78192.168.2.4
                                                        Oct 7, 2024 20:47:14.781414032 CEST60289443192.168.2.4142.250.186.78
                                                        Oct 7, 2024 20:47:14.781593084 CEST44360289142.250.186.78192.168.2.4
                                                        Oct 7, 2024 20:47:14.781625032 CEST60289443192.168.2.4142.250.186.78
                                                        Oct 7, 2024 20:47:14.781672955 CEST60289443192.168.2.4142.250.186.78
                                                        Oct 7, 2024 20:47:14.781697035 CEST44360289142.250.186.78192.168.2.4
                                                        Oct 7, 2024 20:47:14.798455000 CEST44360290142.250.186.78192.168.2.4
                                                        Oct 7, 2024 20:47:14.798660994 CEST60290443192.168.2.4142.250.186.78
                                                        Oct 7, 2024 20:47:14.798679113 CEST44360290142.250.186.78192.168.2.4
                                                        Oct 7, 2024 20:47:14.800349951 CEST44360290142.250.186.78192.168.2.4
                                                        Oct 7, 2024 20:47:14.800637007 CEST60290443192.168.2.4142.250.186.78
                                                        Oct 7, 2024 20:47:14.800766945 CEST60290443192.168.2.4142.250.186.78
                                                        Oct 7, 2024 20:47:14.800782919 CEST44360290142.250.186.78192.168.2.4
                                                        Oct 7, 2024 20:47:14.800807953 CEST60290443192.168.2.4142.250.186.78
                                                        Oct 7, 2024 20:47:14.800863981 CEST44360290142.250.186.78192.168.2.4
                                                        Oct 7, 2024 20:47:14.801105976 CEST44360290142.250.186.78192.168.2.4
                                                        Oct 7, 2024 20:47:14.850666046 CEST60290443192.168.2.4142.250.186.78
                                                        Oct 7, 2024 20:47:15.068664074 CEST44360289142.250.186.78192.168.2.4
                                                        Oct 7, 2024 20:47:15.068985939 CEST44360289142.250.186.78192.168.2.4
                                                        Oct 7, 2024 20:47:15.069210052 CEST60289443192.168.2.4142.250.186.78
                                                        Oct 7, 2024 20:47:15.069628954 CEST60289443192.168.2.4142.250.186.78
                                                        Oct 7, 2024 20:47:15.069662094 CEST44360289142.250.186.78192.168.2.4
                                                        Oct 7, 2024 20:47:15.073285103 CEST4436029113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.073704958 CEST4436029213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.074011087 CEST60291443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.074024916 CEST4436029113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.074111938 CEST60292443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.074171066 CEST4436029213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.074551105 CEST60291443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.074558020 CEST4436029113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.074712038 CEST60292443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.074726105 CEST4436029213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.080971956 CEST4436029313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.081392050 CEST60293443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.081480026 CEST4436029313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.081564903 CEST60293443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.081581116 CEST4436029313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.086596012 CEST44360290142.250.186.78192.168.2.4
                                                        Oct 7, 2024 20:47:15.087232113 CEST44360290142.250.186.78192.168.2.4
                                                        Oct 7, 2024 20:47:15.087301016 CEST60290443192.168.2.4142.250.186.78
                                                        Oct 7, 2024 20:47:15.087378979 CEST60290443192.168.2.4142.250.186.78
                                                        Oct 7, 2024 20:47:15.087434053 CEST44360290142.250.186.78192.168.2.4
                                                        Oct 7, 2024 20:47:15.099623919 CEST4436029413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.100132942 CEST60294443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.100210905 CEST4436029413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.100605965 CEST60294443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.100619078 CEST4436029413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.175220966 CEST4436029113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.175368071 CEST4436029113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.175488949 CEST60291443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.175605059 CEST60291443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.175623894 CEST4436029113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.175642014 CEST60291443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.175652027 CEST4436029113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.176899910 CEST4436029213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.177048922 CEST4436029213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.177134037 CEST60292443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.177134037 CEST60292443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.177211046 CEST60292443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.177248955 CEST4436029213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.179039955 CEST4436029313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.179049015 CEST60297443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.179063082 CEST60296443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.179085016 CEST4436029713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.179111004 CEST4436029313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.179125071 CEST4436029613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.179145098 CEST60297443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.179177999 CEST60293443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.179208994 CEST60296443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.179244995 CEST4436029313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.179333925 CEST60297443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.179349899 CEST4436029713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.179361105 CEST60296443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.179406881 CEST4436029613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.179447889 CEST4436029313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.179476023 CEST60293443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.179528952 CEST4436029313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.179567099 CEST60293443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.179567099 CEST60293443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.179586887 CEST4436029313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.179606915 CEST4436029313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.181453943 CEST4436029513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.181749105 CEST60295443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.181772947 CEST4436029513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.181982040 CEST60298443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.181992054 CEST4436029813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.182041883 CEST60298443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.182077885 CEST60295443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.182090044 CEST4436029513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.182190895 CEST60298443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.182204008 CEST4436029813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.201323986 CEST4436029413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.201469898 CEST4436029413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.201539993 CEST60294443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.201582909 CEST60294443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.201605082 CEST4436029413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.201633930 CEST60294443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.201644897 CEST4436029413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.203315973 CEST60299443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.203360081 CEST4436029913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.203469038 CEST60299443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.203582048 CEST60299443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.203610897 CEST4436029913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.281192064 CEST4436029513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.282155991 CEST4436029513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.282236099 CEST60295443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.282300949 CEST4436029513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.282341003 CEST4436029513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.282402039 CEST60295443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.282402039 CEST60295443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.282450914 CEST4436029513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.284864902 CEST60300443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.284904003 CEST4436030013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.284972906 CEST60300443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.285136938 CEST60300443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.285152912 CEST4436030013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.793355942 CEST4436029613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.793860912 CEST60296443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.793939114 CEST4436029613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.794289112 CEST60296443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.794302940 CEST4436029613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.806802988 CEST4436029713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.807193041 CEST60297443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.807230949 CEST4436029713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.807553053 CEST60297443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.807559967 CEST4436029713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.811430931 CEST4436029813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.811659098 CEST60298443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.811671019 CEST4436029813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.811976910 CEST60298443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.811980963 CEST4436029813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.814572096 CEST4436029913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.814783096 CEST60299443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.814821005 CEST4436029913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.815080881 CEST60299443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.815095901 CEST4436029913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.887631893 CEST4436029613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.887698889 CEST4436029613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.887797117 CEST4436029613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.887924910 CEST60296443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.887924910 CEST60296443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.893685102 CEST60296443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.893685102 CEST60296443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.893727064 CEST4436029613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.893754959 CEST4436029613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.896589041 CEST4436030013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.898255110 CEST60301443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.898312092 CEST4436030113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.898370981 CEST60301443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.905244112 CEST4436029713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.905376911 CEST4436029713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.905433893 CEST60297443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.906411886 CEST60300443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.906446934 CEST4436030013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.908971071 CEST4436029813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.909122944 CEST4436029813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.909172058 CEST60298443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.909807920 CEST4436029913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.909816027 CEST60300443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.909828901 CEST4436030013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.910149097 CEST4436029913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.910206079 CEST60299443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.910231113 CEST4436029913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.910259962 CEST4436029913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.910311937 CEST60299443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.935338020 CEST60298443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.935338020 CEST60298443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.935375929 CEST4436029813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.935415030 CEST4436029813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.937442064 CEST60299443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.937442064 CEST60299443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.937467098 CEST4436029913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.937488079 CEST4436029913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.952212095 CEST60301443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.952255011 CEST4436030113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.957428932 CEST60297443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.957442999 CEST4436029713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.995733976 CEST60302443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.995769024 CEST4436030213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.995857954 CEST60302443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.997068882 CEST60302443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.997087002 CEST4436030213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.998897076 CEST60303443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.998977900 CEST4436030313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:15.999059916 CEST60303443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.999305964 CEST60303443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:15.999337912 CEST4436030313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.000269890 CEST60304443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:16.000351906 CEST4436030413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.000412941 CEST60304443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:16.000679970 CEST60304443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:16.000704050 CEST4436030413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.001635075 CEST4436030013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.001808882 CEST4436030013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.001868963 CEST60300443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:16.001912117 CEST60300443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:16.001934052 CEST4436030013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.003618002 CEST60305443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:16.003705025 CEST4436030513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.003779888 CEST60305443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:16.003879070 CEST60305443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:16.003905058 CEST4436030513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.173760891 CEST44360235142.250.185.132192.168.2.4
                                                        Oct 7, 2024 20:47:16.173882961 CEST44360235142.250.185.132192.168.2.4
                                                        Oct 7, 2024 20:47:16.173954964 CEST60235443192.168.2.4142.250.185.132
                                                        Oct 7, 2024 20:47:16.512305975 CEST4436030113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.513041019 CEST60301443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:16.513071060 CEST4436030113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.513452053 CEST60301443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:16.513458014 CEST4436030113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.609210968 CEST4436030113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.609296083 CEST4436030113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.609536886 CEST60301443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:16.609559059 CEST4436030113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.609735012 CEST4436030113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.609786987 CEST60301443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:16.609786987 CEST60301443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:16.609786987 CEST60301443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:16.609818935 CEST4436030113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.612441063 CEST60306443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:16.612525940 CEST4436030613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.612754107 CEST60306443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:16.612754107 CEST60306443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:16.612888098 CEST4436030613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.614734888 CEST4436030213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.615118027 CEST60302443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:16.615138054 CEST4436030213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.615606070 CEST60302443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:16.615611076 CEST4436030213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.615618944 CEST4436030413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.615869999 CEST60304443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:16.615942001 CEST4436030413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.616322041 CEST60304443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:16.616333961 CEST4436030413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.618484020 CEST4436030313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.618791103 CEST60303443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:16.618845940 CEST4436030313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.619318962 CEST60303443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:16.619333029 CEST4436030313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.643769979 CEST4436030513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.644311905 CEST60305443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:16.644395113 CEST4436030513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.644814014 CEST60305443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:16.644829035 CEST4436030513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.707911015 CEST4436030213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.708360910 CEST4436030213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.708414078 CEST60302443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:16.708439112 CEST60302443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:16.708448887 CEST4436030213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.708456993 CEST60302443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:16.708460093 CEST4436030213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.712522030 CEST4436030413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.712692022 CEST4436030413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.712755919 CEST60304443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:16.713485956 CEST4436030313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.713627100 CEST4436030313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.713794947 CEST60303443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:16.713895082 CEST60307443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:16.713984966 CEST4436030713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.714024067 CEST60304443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:16.714024067 CEST60304443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:16.714051962 CEST4436030413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.714082003 CEST4436030413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.714134932 CEST60307443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:16.720289946 CEST60307443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:16.720325947 CEST4436030713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.720487118 CEST60303443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:16.720487118 CEST60303443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:16.720551014 CEST4436030313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.720585108 CEST4436030313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.730868101 CEST60308443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:16.730952024 CEST4436030813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.731057882 CEST60308443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:16.735156059 CEST60308443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:16.735233068 CEST4436030813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.736171007 CEST60309443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:16.736236095 CEST4436030913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.736298084 CEST60309443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:16.736444950 CEST60309443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:16.736459017 CEST4436030913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.743835926 CEST4436030513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.743946075 CEST4436030513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.744005919 CEST60305443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:16.744069099 CEST4436030513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.744173050 CEST60305443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:16.744174004 CEST60305443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:16.744195938 CEST4436030513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.744374990 CEST4436030513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.745949030 CEST60310443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:16.745971918 CEST4436031013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.746038914 CEST60310443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:16.746134043 CEST60310443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:16.746145964 CEST4436031013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:16.913016081 CEST60301443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:16.913074970 CEST4436030113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:17.285759926 CEST4436030613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:17.287631989 CEST60306443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:17.287672043 CEST4436030613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:17.288672924 CEST60306443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:17.288686037 CEST4436030613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:17.372597933 CEST4436030713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:17.373191118 CEST60307443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:17.373250961 CEST4436030713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:17.373894930 CEST60307443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:17.373948097 CEST4436030713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:17.376594067 CEST4436030813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:17.376904964 CEST60308443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:17.376960993 CEST4436030813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:17.377438068 CEST60308443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:17.377453089 CEST4436030813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:17.382560015 CEST4436031013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:17.383939981 CEST4436030613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:17.383981943 CEST60310443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:17.384010077 CEST4436031013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:17.384114027 CEST4436030613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:17.384181023 CEST60306443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:17.384490013 CEST60310443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:17.384500027 CEST4436031013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:17.385238886 CEST60306443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:17.385272026 CEST4436030613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:17.385298967 CEST60306443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:17.385329008 CEST4436030613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:17.387969017 CEST60311443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:17.388021946 CEST4436031113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:17.388106108 CEST60311443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:17.388286114 CEST60311443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:17.388302088 CEST4436031113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:17.398003101 CEST4436030913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:17.398374081 CEST60309443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:17.398401022 CEST4436030913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:17.398716927 CEST60309443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:17.398726940 CEST4436030913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:17.467797995 CEST4436030713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:17.467869043 CEST4436030713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:17.467978954 CEST4436030713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:17.468146086 CEST60307443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:17.468146086 CEST60307443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:17.468296051 CEST60307443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:17.468296051 CEST60307443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:17.468342066 CEST4436030713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:17.468369961 CEST4436030713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:17.471518040 CEST60312443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:17.471561909 CEST4436031213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:17.471642017 CEST60312443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:17.471797943 CEST60312443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:17.471806049 CEST4436031213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:17.474848032 CEST4436030813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:17.474994898 CEST4436030813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:17.475059986 CEST60308443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:17.475410938 CEST60308443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:17.475410938 CEST60308443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:17.475476027 CEST4436030813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:17.475512028 CEST4436030813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:17.478344917 CEST60313443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:17.478425980 CEST4436031313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:17.478524923 CEST60313443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:17.478632927 CEST60313443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:17.478652000 CEST4436031313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:17.500443935 CEST4436030913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:17.500592947 CEST4436030913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:17.500785112 CEST60309443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:17.500786066 CEST60309443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:17.500786066 CEST60309443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:17.502796888 CEST60314443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:17.502878904 CEST4436031413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:17.502966881 CEST60314443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:17.503084898 CEST60314443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:17.503103971 CEST4436031413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:17.508641958 CEST4436031013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:17.508996964 CEST4436031013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:17.509067059 CEST60310443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:17.509104967 CEST60310443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:17.509104967 CEST60310443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:17.509166002 CEST4436031013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:17.509197950 CEST4436031013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:17.511183977 CEST60315443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:17.511207104 CEST4436031513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:17.511264086 CEST60315443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:17.511359930 CEST60315443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:17.511365891 CEST4436031513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:17.802473068 CEST60309443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:17.802540064 CEST4436030913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.018460035 CEST4436031113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.018956900 CEST60311443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.019032001 CEST4436031113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.019421101 CEST60311443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.019433975 CEST4436031113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.096208096 CEST4436031313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.096793890 CEST60313443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.096878052 CEST4436031313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.097177982 CEST60313443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.097193003 CEST4436031313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.115070105 CEST4436031113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.115422010 CEST4436031113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.115475893 CEST60311443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.115509987 CEST4436031113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.115541935 CEST4436031113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.115590096 CEST60311443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.121018887 CEST60311443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.121018887 CEST60311443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.121049881 CEST4436031113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.121071100 CEST4436031113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.124345064 CEST60316443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.124453068 CEST4436031613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.124531984 CEST60316443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.124764919 CEST60316443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.124802113 CEST4436031613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.159615040 CEST4436031413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.160034895 CEST60314443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.160084009 CEST4436031413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.160410881 CEST60314443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.160427094 CEST4436031413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.161178112 CEST4436031513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.161403894 CEST60315443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.161439896 CEST4436031513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.161712885 CEST60315443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.161720037 CEST4436031513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.190399885 CEST4436031213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.190700054 CEST60312443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.190716982 CEST4436031213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.190995932 CEST60312443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.191000938 CEST4436031213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.196264029 CEST4436031313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.196333885 CEST4436031313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.196399927 CEST60313443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.196422100 CEST4436031313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.196449995 CEST4436031313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.196507931 CEST60313443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.196554899 CEST60313443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.196554899 CEST60313443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.196583033 CEST4436031313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.196604967 CEST4436031313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.198645115 CEST60317443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.198714972 CEST4436031713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.198791027 CEST60317443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.198887110 CEST60317443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.198905945 CEST4436031713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.260622978 CEST4436031413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.260822058 CEST4436031413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.260900974 CEST60314443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.264589071 CEST4436031513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.264750004 CEST4436031513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.264805079 CEST60315443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.271421909 CEST60314443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.271445990 CEST4436031413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.271470070 CEST60314443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.271482944 CEST4436031413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.272288084 CEST60315443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.272316933 CEST4436031513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.272330999 CEST60315443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.272340059 CEST4436031513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.274286032 CEST60318443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.274303913 CEST60319443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.274347067 CEST4436031813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.274370909 CEST4436031913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.274435043 CEST60318443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.274456024 CEST60319443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.274545908 CEST60318443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.274563074 CEST4436031813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.274606943 CEST60319443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.274621964 CEST4436031913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.285093069 CEST4436031213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.285439014 CEST4436031213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.285509109 CEST60312443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.285542965 CEST60312443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.285550117 CEST4436031213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.285562038 CEST60312443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.285567045 CEST4436031213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.287853956 CEST60320443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.287873983 CEST4436032013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.287935972 CEST60320443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.292493105 CEST60320443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.292519093 CEST4436032013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.786879063 CEST4436031613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.787506104 CEST60316443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.787570000 CEST4436031613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.787858009 CEST60316443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.787873983 CEST4436031613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.824649096 CEST4436031713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.825262070 CEST60317443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.825304031 CEST4436031713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.825670958 CEST60317443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.825685024 CEST4436031713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.881650925 CEST4436031613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.881831884 CEST4436031613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.881972075 CEST60316443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.881972075 CEST60316443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.884586096 CEST60316443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.884624958 CEST4436031613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.884695053 CEST60321443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.884778976 CEST4436032113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.884865046 CEST60321443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.884989977 CEST60321443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.885023117 CEST4436032113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.895126104 CEST4436031813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.895755053 CEST60318443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.895814896 CEST4436031813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.895982981 CEST60318443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.895998001 CEST4436031813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.917748928 CEST4436031913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.918171883 CEST60319443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.918231010 CEST4436031913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.918462038 CEST60319443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.918478012 CEST4436031913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.924168110 CEST4436031713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.924338102 CEST4436031713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.924432993 CEST60317443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.924511909 CEST60317443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.924549103 CEST4436031713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.924590111 CEST60317443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.924612999 CEST4436031713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.926486015 CEST60322443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.926526070 CEST4436032213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.926610947 CEST60322443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.926767111 CEST60322443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.926786900 CEST4436032213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.946695089 CEST4436032013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.946962118 CEST60320443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.946970940 CEST4436032013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.947277069 CEST60320443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.947280884 CEST4436032013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.996474028 CEST4436031813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.996556044 CEST4436031813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.996685982 CEST60318443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.996773958 CEST60318443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.996773958 CEST60318443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.996817112 CEST4436031813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.996855021 CEST4436031813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.998596907 CEST60323443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.998640060 CEST4436032313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:18.998718977 CEST60323443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.998836994 CEST60323443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:18.998856068 CEST4436032313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:19.017602921 CEST4436031913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:19.017781973 CEST4436031913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:19.017855883 CEST60319443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:19.017880917 CEST60319443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:19.017880917 CEST60319443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:19.017890930 CEST4436031913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:19.017900944 CEST4436031913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:19.019630909 CEST60324443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:19.019664049 CEST4436032413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:19.019728899 CEST60324443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:19.019839048 CEST60324443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:19.019845963 CEST4436032413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:19.072355032 CEST4436032013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:19.072715998 CEST4436032013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:19.072884083 CEST60320443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:19.072901964 CEST60320443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:19.072907925 CEST4436032013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:19.072918892 CEST60320443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:19.072925091 CEST4436032013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:19.074542999 CEST60325443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:19.074625015 CEST4436032513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:19.074706078 CEST60325443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:19.074820995 CEST60325443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:19.074845076 CEST4436032513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:19.551635027 CEST4436032213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:19.552083969 CEST60322443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:19.552107096 CEST4436032213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:19.552772999 CEST60322443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:19.552778959 CEST4436032213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:19.631513119 CEST4436032413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:19.633353949 CEST60324443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:19.633384943 CEST4436032413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:19.633675098 CEST60324443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:19.633681059 CEST4436032413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:19.646900892 CEST4436032213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:19.647053003 CEST4436032213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:19.647258997 CEST60322443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:19.649168968 CEST60322443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:19.649169922 CEST60322443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:19.649218082 CEST4436032213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:19.649246931 CEST4436032213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:19.649899006 CEST4436032313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:19.652275085 CEST60326443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:19.652313948 CEST4436032613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:19.652472973 CEST60323443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:19.652506113 CEST60326443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:19.652523041 CEST4436032313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:19.652616024 CEST60326443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:19.652635098 CEST4436032613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:19.652879953 CEST60323443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:19.652888060 CEST4436032313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:19.722352982 CEST4436032513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:19.723395109 CEST60325443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:19.723453999 CEST4436032513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:19.723651886 CEST60325443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:19.723668098 CEST4436032513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:19.726655006 CEST4436032413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:19.726797104 CEST4436032413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:19.726854086 CEST60324443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:19.726901054 CEST60324443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:19.726918936 CEST4436032413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:19.726931095 CEST60324443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:19.726938009 CEST4436032413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:19.729127884 CEST60327443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:19.729151011 CEST4436032713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:19.729223967 CEST60327443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:19.729389906 CEST60327443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:19.729407072 CEST4436032713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:19.751674891 CEST4436032313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:19.751756907 CEST4436032313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:19.751818895 CEST60323443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:19.751938105 CEST60323443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:19.751938105 CEST60323443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:19.751961946 CEST4436032313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:19.751972914 CEST4436032313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:19.754173040 CEST60328443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:19.754256010 CEST4436032813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:19.754342079 CEST60328443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:19.754462004 CEST60328443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:19.754494905 CEST4436032813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:19.838978052 CEST4436032513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:19.839035988 CEST4436032513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:19.839107990 CEST60325443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:19.839135885 CEST4436032513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:19.839181900 CEST4436032513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:19.839241982 CEST60325443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:19.839368105 CEST60325443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:19.839368105 CEST60325443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:19.839402914 CEST4436032513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:19.839426041 CEST4436032513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:19.841881990 CEST60329443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:19.841978073 CEST4436032913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:19.842060089 CEST60329443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:19.842190981 CEST60329443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:19.842209101 CEST4436032913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.282104969 CEST4436032613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.282903910 CEST60326443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:20.282984018 CEST4436032613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.283309937 CEST60326443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:20.283363104 CEST4436032613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.352643967 CEST4436032713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.353050947 CEST60327443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:20.353072882 CEST4436032713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.353657007 CEST60327443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:20.353662968 CEST4436032713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.373579025 CEST4436032813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.373992920 CEST60328443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:20.374074936 CEST4436032813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.374320984 CEST60328443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:20.374336958 CEST4436032813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.379802942 CEST4436032613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.380213976 CEST4436032613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.380284071 CEST60326443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:20.380312920 CEST4436032613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.380381107 CEST60326443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:20.380438089 CEST60326443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:20.380438089 CEST60326443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:20.380477905 CEST4436032613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.380505085 CEST4436032613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.383117914 CEST60330443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:20.383208036 CEST4436033013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.383301020 CEST60330443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:20.383466005 CEST60330443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:20.383491039 CEST4436033013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.420968056 CEST4436032113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.421439886 CEST60321443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:20.421500921 CEST4436032113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.421624899 CEST60321443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:20.421639919 CEST4436032113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.451642036 CEST4436032713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.451730013 CEST4436032713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.451771021 CEST60327443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:20.451783895 CEST4436032713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.451862097 CEST4436032713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.451899052 CEST60327443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:20.451924086 CEST4436032713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.451939106 CEST60327443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:20.451939106 CEST60327443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:20.451950073 CEST4436032713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.451960087 CEST4436032713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.454071999 CEST60331443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:20.454154015 CEST4436033113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.454231977 CEST60331443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:20.454329967 CEST60331443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:20.454355001 CEST4436033113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.459464073 CEST4436032913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.459734917 CEST60329443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:20.459767103 CEST4436032913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.460324049 CEST60329443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:20.460334063 CEST4436032913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.471693993 CEST4436032813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.471759081 CEST4436032813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.471821070 CEST60328443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:20.471927881 CEST60328443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:20.471927881 CEST60328443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:20.471955061 CEST4436032813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.471976995 CEST4436032813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.473875046 CEST60332443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:20.473953962 CEST4436033213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.474018097 CEST60332443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:20.474123001 CEST60332443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:20.474154949 CEST4436033213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.517254114 CEST4436032113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.517620087 CEST4436032113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.517688036 CEST60321443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:20.517712116 CEST4436032113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.517774105 CEST60321443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:20.517834902 CEST60321443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:20.517836094 CEST60321443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:20.517875910 CEST4436032113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.517906904 CEST4436032113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.520083904 CEST60333443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:20.520183086 CEST4436033313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.520256042 CEST60333443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:20.520430088 CEST60333443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:20.520468950 CEST4436033313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.557504892 CEST4436032913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.557579994 CEST4436032913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.557641029 CEST60329443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:20.557672024 CEST4436032913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.557701111 CEST4436032913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.557748079 CEST60329443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:20.557974100 CEST60329443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:20.558005095 CEST4436032913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.558031082 CEST60329443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:20.558043003 CEST4436032913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.562378883 CEST60334443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:20.562407970 CEST4436033413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:20.562474966 CEST60334443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:20.562745094 CEST60334443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:20.562769890 CEST4436033413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.013684988 CEST4436033013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.014484882 CEST60330443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.014514923 CEST4436033013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.014880896 CEST60330443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.014895916 CEST4436033013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.075495005 CEST4436033113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.076059103 CEST60331443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.076116085 CEST4436033113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.076421022 CEST60331443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.076474905 CEST4436033113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.096038103 CEST4436033213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.096364021 CEST60332443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.096443892 CEST4436033213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.096692085 CEST60332443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.096705914 CEST4436033213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.108045101 CEST4436033013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.108433008 CEST4436033013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.108530045 CEST60330443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.108613014 CEST60330443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.108613014 CEST60330443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.108655930 CEST4436033013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.108689070 CEST4436033013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.111094952 CEST60335443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.111177921 CEST4436033513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.111274958 CEST60335443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.111469030 CEST60335443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.111502886 CEST4436033513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.160588980 CEST4436033313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.161226034 CEST60333443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.161252022 CEST4436033313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.161520958 CEST60333443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.161529064 CEST4436033313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.171547890 CEST4436033113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.171593904 CEST4436033113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.171711922 CEST4436033113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.171814919 CEST60331443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.171814919 CEST60331443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.171902895 CEST60331443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.171902895 CEST60331443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.171943903 CEST4436033113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.171978951 CEST4436033113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.173858881 CEST60336443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.173943043 CEST4436033613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.174046040 CEST60336443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.174143076 CEST60336443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.174165010 CEST4436033613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.193176985 CEST4436033213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.193552971 CEST4436033213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.193623066 CEST4436033213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.193747044 CEST60332443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.193747997 CEST60332443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.193747997 CEST60332443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.193747997 CEST60332443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.193840981 CEST4436033213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.195779085 CEST60337443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.195811033 CEST4436033713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.196919918 CEST60337443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.197401047 CEST60337443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.197417021 CEST4436033713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.204713106 CEST4436033413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.205136061 CEST60334443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.205152988 CEST4436033413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.205502033 CEST60334443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.205507994 CEST4436033413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.257792950 CEST4436033313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.258610964 CEST4436033313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.258672953 CEST60333443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.258702040 CEST4436033313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.258723974 CEST4436033313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.258785963 CEST60333443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.258811951 CEST4436033313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.258825064 CEST60333443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.258825064 CEST60333443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.258833885 CEST4436033313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.258841991 CEST4436033313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.260957003 CEST60338443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.260974884 CEST4436033813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.261105061 CEST60338443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.261188984 CEST60338443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.261193991 CEST4436033813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.306139946 CEST4436033413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.306304932 CEST4436033413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.306365013 CEST60334443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.306406975 CEST60334443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.306416035 CEST4436033413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.306428909 CEST60334443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.306432962 CEST4436033413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.308567047 CEST60339443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.308650970 CEST4436033913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.308748007 CEST60339443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.308882952 CEST60339443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.308911085 CEST4436033913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.506653070 CEST60332443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.506675959 CEST4436033213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.722878933 CEST4436033513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.725800991 CEST60335443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.725833893 CEST4436033513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.726193905 CEST60335443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.726207972 CEST4436033513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.784347057 CEST4436033613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.785196066 CEST60336443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.785255909 CEST4436033613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.785527945 CEST60336443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.785542011 CEST4436033613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.806037903 CEST4436033713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.809295893 CEST60337443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.809317112 CEST4436033713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.809782982 CEST60337443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.809792995 CEST4436033713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.817043066 CEST4436033513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.817254066 CEST4436033513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.817338943 CEST60335443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.817634106 CEST60335443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.817634106 CEST60335443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.817698956 CEST4436033513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.817733049 CEST4436033513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.820343971 CEST60340443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.820426941 CEST4436034013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.820656061 CEST60340443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.820657015 CEST60340443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.820786953 CEST4436034013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.876765013 CEST4436033813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.877088070 CEST4436033613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.877136946 CEST60338443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.877142906 CEST4436033813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.877242088 CEST4436033613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.877430916 CEST60336443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.877432108 CEST60336443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.877432108 CEST60336443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.877578974 CEST60338443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.877583027 CEST4436033813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.879174948 CEST60341443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.879228115 CEST4436034113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.879288912 CEST60341443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.879395962 CEST60341443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.879405022 CEST4436034113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.902457952 CEST4436033713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.902825117 CEST4436033713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.902872086 CEST4436033713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.902964115 CEST60337443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.903016090 CEST60337443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.903016090 CEST60337443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.903028965 CEST4436033713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.903034925 CEST4436033713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.905186892 CEST60342443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.905221939 CEST4436034213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.905380964 CEST60342443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.905502081 CEST60342443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.905508995 CEST4436034213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.924551964 CEST4436033913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.925240040 CEST60339443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.925298929 CEST4436033913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.925672054 CEST60339443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.925687075 CEST4436033913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.971620083 CEST4436033813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.971750021 CEST4436033813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.971867085 CEST60338443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.971941948 CEST60338443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.971941948 CEST60338443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.971950054 CEST4436033813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.971956968 CEST4436033813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.973499060 CEST60343443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.973582029 CEST4436034313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:21.973675013 CEST60343443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.973766088 CEST60343443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:21.973783970 CEST4436034313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.075687885 CEST4436033913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.075802088 CEST4436033913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.075850964 CEST4436033913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.075983047 CEST60339443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:22.075983047 CEST60339443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:22.075983047 CEST60339443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:22.076073885 CEST4436033913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.076118946 CEST60339443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:22.076136112 CEST4436033913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.077548981 CEST60344443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:22.077636957 CEST4436034413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.077706099 CEST60344443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:22.077814102 CEST60344443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:22.077831984 CEST4436034413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.193734884 CEST60336443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:22.193797112 CEST4436033613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.434730053 CEST4436034013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.435327053 CEST60340443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:22.435408115 CEST4436034013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.435626984 CEST60340443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:22.435642004 CEST4436034013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.504976034 CEST4436034113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.505417109 CEST60341443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:22.505497932 CEST4436034113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.505752087 CEST60341443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:22.505764961 CEST4436034113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.529604912 CEST4436034013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.529859066 CEST4436034013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.529949903 CEST60340443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:22.529949903 CEST60340443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:22.530026913 CEST60340443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:22.530062914 CEST4436034013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.532805920 CEST60345443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:22.532885075 CEST4436034513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.532988071 CEST60345443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:22.533119917 CEST60345443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:22.533143044 CEST4436034513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.552046061 CEST4436034213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.552427053 CEST60342443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:22.552462101 CEST4436034213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.553101063 CEST60342443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:22.553111076 CEST4436034213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.605011940 CEST4436034113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.605083942 CEST4436034113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.605185986 CEST4436034113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.605257034 CEST60341443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:22.605338097 CEST60341443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:22.605338097 CEST60341443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:22.605372906 CEST4436034113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.605396032 CEST4436034113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.607989073 CEST60346443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:22.608020067 CEST4436034613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.608122110 CEST60346443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:22.608263016 CEST60346443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:22.608278990 CEST4436034613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.630923033 CEST4436034313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.631294012 CEST60343443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:22.631371021 CEST4436034313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.631627083 CEST60343443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:22.631640911 CEST4436034313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.653728962 CEST4436034213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.653805017 CEST4436034213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.653919935 CEST60342443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:22.653956890 CEST60342443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:22.653969049 CEST4436034213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.654007912 CEST60342443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:22.654021978 CEST4436034213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.655807018 CEST60347443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:22.655877113 CEST4436034713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.655946016 CEST60347443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:22.656033039 CEST60347443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:22.656078100 CEST4436034713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.723256111 CEST4436034413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.724389076 CEST60344443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:22.724440098 CEST4436034413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.724927902 CEST60344443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:22.724939108 CEST4436034413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.726869106 CEST4436034313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.727020025 CEST4436034313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.727150917 CEST60343443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:22.727231979 CEST60343443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:22.727231979 CEST60343443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:22.727281094 CEST4436034313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.727309942 CEST4436034313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.729516029 CEST60348443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:22.729568958 CEST4436034813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.729835987 CEST60348443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:22.729968071 CEST60348443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:22.729994059 CEST4436034813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.821660042 CEST4436034413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.821845055 CEST4436034413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.821917057 CEST60344443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:22.821917057 CEST60344443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:22.821960926 CEST60344443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:22.821990013 CEST4436034413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.823961020 CEST60349443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:22.824045897 CEST4436034913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:22.824137926 CEST60349443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:22.824256897 CEST60349443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:22.824290037 CEST4436034913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.193247080 CEST4436034513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.193825006 CEST60345443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:23.193908930 CEST4436034513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.194453955 CEST60345443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:23.194506884 CEST4436034513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.255219936 CEST4436034613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.255603075 CEST60346443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:23.255676031 CEST4436034613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.255971909 CEST60346443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:23.255986929 CEST4436034613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.293252945 CEST4436034513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.293576002 CEST4436034513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.293656111 CEST60345443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:23.293708086 CEST60345443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:23.293740034 CEST4436034513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.293766975 CEST60345443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:23.293781042 CEST4436034513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.296324968 CEST60350443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:23.296348095 CEST4436034713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.296406031 CEST4436035013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.296485901 CEST60350443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:23.296621084 CEST60350443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:23.296644926 CEST4436035013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.296731949 CEST60347443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:23.296788931 CEST4436034713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.297116041 CEST60347443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:23.297130108 CEST4436034713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.354017973 CEST4436034613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.354541063 CEST4436034613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.354726076 CEST60346443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:23.354727030 CEST60346443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:23.354727030 CEST60346443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:23.357856035 CEST60351443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:23.357917070 CEST4436035113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.357991934 CEST60351443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:23.358099937 CEST60351443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:23.358114004 CEST4436035113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.371215105 CEST4436034813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.371530056 CEST60348443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:23.371558905 CEST4436034813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.371922016 CEST60348443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:23.371932983 CEST4436034813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.395821095 CEST4436034713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.395854950 CEST4436034713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.395896912 CEST4436034713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.395903111 CEST60347443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:23.395950079 CEST60347443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:23.396158934 CEST60347443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:23.396158934 CEST60347443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:23.396189928 CEST4436034713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.396212101 CEST4436034713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.400423050 CEST60352443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:23.400466919 CEST4436035213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.400532961 CEST60352443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:23.400686979 CEST60352443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:23.400700092 CEST4436035213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.471882105 CEST4436034813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.472038031 CEST4436034813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.472100019 CEST60348443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:23.472208023 CEST60348443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:23.472234964 CEST4436034813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.472259998 CEST60348443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:23.472275019 CEST4436034813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.475430012 CEST60353443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:23.475512981 CEST4436035313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.475605965 CEST60353443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:23.475934982 CEST60353443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:23.476022959 CEST4436035313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.479199886 CEST4436034913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.479608059 CEST60349443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:23.479693890 CEST4436034913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.479814053 CEST60349443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:23.479830027 CEST4436034913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.581899881 CEST4436034913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.581931114 CEST4436034913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.581975937 CEST4436034913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.582142115 CEST60349443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:23.582142115 CEST60349443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:23.582231045 CEST60349443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:23.582231045 CEST60349443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:23.582272053 CEST4436034913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.582302094 CEST4436034913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.584672928 CEST60354443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:23.584753990 CEST4436035413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.584856987 CEST60354443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:23.584954977 CEST60354443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:23.584976912 CEST4436035413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.666217089 CEST60346443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:23.666276932 CEST4436034613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.909507036 CEST4436035013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.910150051 CEST60350443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:23.910229921 CEST4436035013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.910566092 CEST60350443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:23.910619020 CEST4436035013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.972537041 CEST4436035113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.973004103 CEST60351443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:23.973056078 CEST4436035113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:23.973382950 CEST60351443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:23.973396063 CEST4436035113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.004456997 CEST4436035013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.004607916 CEST4436035013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.004816055 CEST60350443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.004817009 CEST60350443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.004817009 CEST60350443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.007764101 CEST60355443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.007827997 CEST4436035513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.007896900 CEST60355443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.008034945 CEST60355443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.008049011 CEST4436035513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.020417929 CEST4436035213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.020726919 CEST60352443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.020756006 CEST4436035213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.021058083 CEST60352443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.021068096 CEST4436035213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.067728043 CEST4436035113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.067800999 CEST4436035113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.067883015 CEST60351443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.067898035 CEST4436035113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.067955017 CEST60351443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.068089962 CEST60351443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.068089962 CEST60351443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.068118095 CEST4436035113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.068141937 CEST4436035113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.070043087 CEST60356443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.070084095 CEST4436035613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.070161104 CEST60356443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.070281982 CEST60356443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.070293903 CEST4436035613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.101752043 CEST4436035313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.102164984 CEST60353443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.102245092 CEST4436035313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.102325916 CEST60353443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.102340937 CEST4436035313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.116225958 CEST4436035213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.116297960 CEST4436035213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.116398096 CEST60352443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.116559029 CEST60352443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.116580009 CEST4436035213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.116621971 CEST60352443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.116635084 CEST4436035213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.118216991 CEST60357443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.118299961 CEST4436035713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.118395090 CEST60357443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.118510962 CEST60357443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.118542910 CEST4436035713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.192512989 CEST4436035413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.192965031 CEST60354443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.193048954 CEST4436035413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.193341017 CEST60354443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.193393946 CEST4436035413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.202043056 CEST4436035313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.202349901 CEST4436035313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.202404022 CEST4436035313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.202423096 CEST60353443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.202488899 CEST60353443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.202488899 CEST60353443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.202532053 CEST60353443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.202568054 CEST4436035313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.204144001 CEST60358443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.204226971 CEST4436035813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.204330921 CEST60358443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.204416990 CEST60358443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.204449892 CEST4436035813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.317958117 CEST60350443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.318018913 CEST4436035013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.328105927 CEST4436035413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.328181982 CEST4436035413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.328345060 CEST60354443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.328428984 CEST60354443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.328428984 CEST60354443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.328469038 CEST4436035413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.328500032 CEST4436035413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.331262112 CEST60359443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.331355095 CEST4436035913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.331435919 CEST60359443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.331623077 CEST60359443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.331645012 CEST4436035913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.624324083 CEST4436035513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.624785900 CEST60355443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.624829054 CEST4436035513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.625169992 CEST60355443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.625183105 CEST4436035513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.687043905 CEST4436035613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.687438011 CEST60356443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.687470913 CEST4436035613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.687722921 CEST60356443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.687731028 CEST4436035613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.718477011 CEST4436035513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.718527079 CEST4436035513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.718655109 CEST60355443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.718674898 CEST4436035513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.718890905 CEST60355443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.718921900 CEST4436035513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.718943119 CEST60355443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.719413042 CEST4436035513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.719628096 CEST4436035513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.719686031 CEST60355443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.721432924 CEST60360443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.721515894 CEST4436036013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.721625090 CEST60360443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.721712112 CEST60360443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.721730947 CEST4436036013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.726432085 CEST4436035713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.726746082 CEST60357443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.726803064 CEST4436035713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.727149963 CEST60357443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.727163076 CEST4436035713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.782618046 CEST4436035613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.782661915 CEST4436035613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.782778978 CEST60356443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.782821894 CEST4436035613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.782851934 CEST4436035613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.782922983 CEST60356443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.782985926 CEST4436035613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.783021927 CEST60356443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.783021927 CEST60356443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.783045053 CEST4436035613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.783062935 CEST4436035613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.785096884 CEST60361443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.785130978 CEST4436036113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.785197973 CEST60361443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.785340071 CEST60361443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.785345078 CEST4436036113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.823949099 CEST4436035813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.824388981 CEST60358443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.824455976 CEST4436035813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.824593067 CEST60358443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.824608088 CEST4436035813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.825747967 CEST4436035713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.825820923 CEST4436035713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.825927019 CEST4436035713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.825961113 CEST60357443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.826018095 CEST60357443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.826081038 CEST60357443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.826081038 CEST60357443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.826109886 CEST4436035713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.826131105 CEST4436035713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.828186035 CEST60362443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.828207016 CEST4436036213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.828284025 CEST60362443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.828489065 CEST60362443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.828502893 CEST4436036213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.924616098 CEST4436035813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.924709082 CEST4436035813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.924918890 CEST60358443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.925000906 CEST60358443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.925000906 CEST60358443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.925043106 CEST4436035813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.925072908 CEST4436035813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.927143097 CEST60363443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.927223921 CEST4436036313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.929086924 CEST60363443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.930736065 CEST60363443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.930816889 CEST4436036313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.951292038 CEST4436035913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.951731920 CEST60359443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.951818943 CEST4436035913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:24.956567049 CEST60359443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:24.956588984 CEST4436035913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.080363035 CEST4436035913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.080403090 CEST4436035913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.080459118 CEST4436035913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.080501080 CEST60359443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:25.080558062 CEST60359443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:25.080715895 CEST60359443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:25.080715895 CEST60359443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:25.080754042 CEST4436035913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.080779076 CEST4436035913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.083394051 CEST60364443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:25.083477974 CEST4436036413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.083589077 CEST60364443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:25.084188938 CEST60364443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:25.084269047 CEST4436036413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.348990917 CEST4436036013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.349775076 CEST60360443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:25.349855900 CEST4436036013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.350249052 CEST60360443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:25.350301981 CEST4436036013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.439312935 CEST4436036113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.439981937 CEST60361443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:25.440005064 CEST4436036113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.440278053 CEST60361443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:25.440296888 CEST4436036113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.443557024 CEST4436036013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.443782091 CEST4436036013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.443969965 CEST60360443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:25.443969965 CEST60360443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:25.443969965 CEST60360443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:25.446341038 CEST4436036213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.446480036 CEST60365443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:25.446568012 CEST4436036513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.446610928 CEST60362443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:25.446633101 CEST4436036213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.446666956 CEST60365443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:25.446754932 CEST60365443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:25.446774960 CEST4436036513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.446914911 CEST60362443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:25.446921110 CEST4436036213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.533895969 CEST4436036113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.533970118 CEST4436036113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.534058094 CEST60361443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:25.534070969 CEST4436036113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.534192085 CEST60361443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:25.534213066 CEST4436036113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.534229994 CEST60361443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:25.534235954 CEST4436036113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.534245968 CEST60361443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:25.534249067 CEST4436036113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.536454916 CEST60366443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:25.536545038 CEST4436036613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.536638021 CEST60366443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:25.536731958 CEST60366443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:25.536751986 CEST4436036613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.542805910 CEST4436036213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.542953014 CEST4436036213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.543032885 CEST60362443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:25.543158054 CEST60362443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:25.543162107 CEST4436036213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.543186903 CEST60362443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:25.543190956 CEST4436036213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.544926882 CEST60367443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:25.545011044 CEST4436036713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.545095921 CEST60367443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:25.545279026 CEST60367443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:25.545311928 CEST4436036713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.569710016 CEST4436036313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.570219040 CEST60363443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:25.570276976 CEST4436036313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.570596933 CEST60363443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:25.570610046 CEST4436036313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.668421984 CEST4436036313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.668473959 CEST4436036313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.668517113 CEST4436036313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.668679953 CEST60363443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:25.668680906 CEST60363443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:25.668771029 CEST60363443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:25.668807983 CEST4436036313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.668860912 CEST60363443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:25.668878078 CEST4436036313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.670490980 CEST60368443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:25.670572042 CEST4436036813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.673053026 CEST60368443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:25.673053026 CEST60368443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:25.673180103 CEST4436036813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.720045090 CEST4436036413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.721333981 CEST60364443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:25.721395016 CEST4436036413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.721699953 CEST60364443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:25.721754074 CEST4436036413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.758171082 CEST60360443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:25.758232117 CEST4436036013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.821033955 CEST4436036413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.821095943 CEST4436036413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.821168900 CEST60364443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:25.821326971 CEST60364443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:25.821326971 CEST60364443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:25.821379900 CEST4436036413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.821409941 CEST4436036413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.823700905 CEST60369443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:25.823772907 CEST4436036913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:25.823869944 CEST60369443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:25.823971987 CEST60369443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:25.823987961 CEST4436036913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.123959064 CEST4436036513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.124686003 CEST60365443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.124747038 CEST4436036513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.125030994 CEST60365443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.125046015 CEST4436036513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.160506010 CEST4436036713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.161045074 CEST60367443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.161086082 CEST4436036713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.161362886 CEST60367443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.161390066 CEST4436036713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.173815966 CEST4436036613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.174088955 CEST60366443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.174132109 CEST4436036613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.174385071 CEST60366443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.174396992 CEST4436036613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.224417925 CEST4436036513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.224508047 CEST4436036513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.224591970 CEST60365443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.224623919 CEST4436036513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.224786997 CEST60365443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.224786997 CEST60365443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.224802971 CEST4436036513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.224853039 CEST4436036513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.224860907 CEST60365443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.224894047 CEST4436036513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.227418900 CEST60370443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.227499962 CEST4436037013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.227603912 CEST60370443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.227725983 CEST60370443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.227741957 CEST4436037013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.255624056 CEST4436036713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.255830050 CEST4436036713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.256026983 CEST60367443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.256026983 CEST60367443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.256026983 CEST60367443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.257978916 CEST60371443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.258060932 CEST4436037113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.258306980 CEST60371443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.258306980 CEST60371443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.258435965 CEST4436037113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.273062944 CEST4436036613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.273258924 CEST4436036613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.273350000 CEST60366443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.273406029 CEST60366443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.273406029 CEST60366443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.273432970 CEST4436036613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.273454905 CEST4436036613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.275127888 CEST60372443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.275166035 CEST4436037213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.275233984 CEST60372443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.275331974 CEST60372443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.275338888 CEST4436037213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.279213905 CEST4436036813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.279644012 CEST60368443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.279702902 CEST4436036813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.279858112 CEST60368443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.279872894 CEST4436036813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.374346972 CEST4436036813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.374386072 CEST4436036813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.374429941 CEST4436036813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.374448061 CEST60368443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.374504089 CEST60368443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.374695063 CEST60368443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.374695063 CEST60368443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.374741077 CEST4436036813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.374772072 CEST4436036813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.377429962 CEST60373443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.377509117 CEST4436037313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.377578974 CEST60373443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.377760887 CEST60373443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.377783060 CEST4436037313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.473414898 CEST4436036913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.474286079 CEST60369443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.474344015 CEST4436036913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.475009918 CEST60369443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.475023031 CEST4436036913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.568032026 CEST60367443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.568094015 CEST4436036713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.578640938 CEST4436036913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.578800917 CEST4436036913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.578926086 CEST60369443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.578926086 CEST60369443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.578926086 CEST60369443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.581284046 CEST60374443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.581367016 CEST4436037413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.581459045 CEST60374443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.581579924 CEST60374443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.581599951 CEST4436037413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.860126019 CEST4436037013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.860919952 CEST60370443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.860980988 CEST4436037013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.861243010 CEST60370443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.861258984 CEST4436037013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.880578995 CEST60369443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.880645037 CEST4436036913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.896848917 CEST4436037113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.897380114 CEST60371443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.897438049 CEST4436037113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.897713900 CEST60371443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.897766113 CEST4436037113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.910059929 CEST4436037213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.910525084 CEST60372443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.910542965 CEST4436037213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.910831928 CEST60372443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.910836935 CEST4436037213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.955213070 CEST4436037013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.955363035 CEST4436037013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.955585957 CEST60370443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.955585957 CEST60370443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.955585957 CEST60370443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.958262920 CEST60375443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.958302975 CEST4436037513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.958393097 CEST60375443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.958597898 CEST60375443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.958606005 CEST4436037513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.993470907 CEST4436037113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.993544102 CEST4436037113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.993695021 CEST4436037113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.993793964 CEST60371443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.993794918 CEST60371443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.993887901 CEST60371443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.993925095 CEST4436037113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.993973017 CEST60371443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.993988991 CEST4436037113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.995647907 CEST60376443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.995711088 CEST4436037613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:26.995803118 CEST60376443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.995928049 CEST60376443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:26.995942116 CEST4436037613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.004858017 CEST4436037213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.004996061 CEST4436037213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.005054951 CEST60372443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.005090952 CEST60372443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.005090952 CEST60372443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.005109072 CEST4436037213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.005120993 CEST4436037213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.006889105 CEST60377443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.006973028 CEST4436037713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.007065058 CEST60377443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.007142067 CEST60377443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.007163048 CEST4436037713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.032805920 CEST4436037313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.033276081 CEST60373443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.033318043 CEST4436037313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.033741951 CEST60373443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.033755064 CEST4436037313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.154124975 CEST4436037313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.154165030 CEST4436037313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.154206991 CEST4436037313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.154373884 CEST60373443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.154520035 CEST60373443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.154560089 CEST4436037313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.154618979 CEST60373443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.154634953 CEST4436037313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.157207012 CEST60378443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.157249928 CEST4436037813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.157429934 CEST60378443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.157486916 CEST60378443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.157501936 CEST4436037813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.206681013 CEST4436037413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.207241058 CEST60374443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.207324028 CEST4436037413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.207561970 CEST60374443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.207577944 CEST4436037413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.271152020 CEST60370443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.271202087 CEST4436037013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.303580999 CEST4436037413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.303720951 CEST4436037413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.303900957 CEST60374443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.303981066 CEST60374443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.303981066 CEST60374443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.304023027 CEST4436037413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.304048061 CEST4436037413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.305828094 CEST60379443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.305871964 CEST4436037913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.305943012 CEST60379443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.306041956 CEST60379443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.306051016 CEST4436037913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.803632975 CEST4436037513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.804030895 CEST4436037613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.804321051 CEST60375443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.804343939 CEST4436037513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.804564953 CEST4436037713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.804934978 CEST60375443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.804938078 CEST4436037513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.805190086 CEST60376443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.805224895 CEST4436037613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.805397987 CEST60377443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.805473089 CEST4436037713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.805525064 CEST60376443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.805535078 CEST4436037613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.805742979 CEST60377443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.805764914 CEST4436037713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.897965908 CEST4436037713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.898523092 CEST4436037713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.898612022 CEST60377443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.898690939 CEST60377443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.898730993 CEST4436037713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.898761034 CEST60377443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.898777008 CEST4436037713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.899722099 CEST4436037513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.899988890 CEST4436037513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.900033951 CEST60375443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.900187969 CEST60375443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.900197983 CEST4436037513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.900207043 CEST60375443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.900211096 CEST4436037513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.901731968 CEST60380443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.901767969 CEST4436038013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.901827097 CEST60380443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.901940107 CEST60380443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.901947975 CEST4436038013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.902851105 CEST60381443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.902932882 CEST4436038113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.903013945 CEST60381443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.903120041 CEST60381443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.903141975 CEST4436038113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.933844090 CEST4436037613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.934015989 CEST4436037613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.934135914 CEST4436037613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.934217930 CEST60376443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.934218884 CEST60376443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.934288979 CEST60376443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.934288979 CEST60376443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.934309959 CEST4436037613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.934349060 CEST4436037613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.936017036 CEST60382443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.936098099 CEST4436038213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.936181068 CEST60382443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.936280012 CEST60382443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.936297894 CEST4436038213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.974503040 CEST4436037913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.975120068 CEST60379443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.975148916 CEST4436037913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.975414991 CEST60379443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.975423098 CEST4436037913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.982212067 CEST4436037813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.982631922 CEST60378443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.982716084 CEST4436037813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:27.982861042 CEST60378443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:27.982876062 CEST4436037813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.073786020 CEST4436037913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.073858023 CEST4436037913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.073966026 CEST4436037913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.074058056 CEST60379443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.074058056 CEST60379443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.074194908 CEST60379443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.074194908 CEST60379443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.074239969 CEST4436037913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.074268103 CEST4436037913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.076514959 CEST60383443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.076540947 CEST4436038313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.076616049 CEST60383443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.076780081 CEST60383443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.076795101 CEST4436038313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.157912970 CEST4436037813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.158339977 CEST4436037813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.158438921 CEST60378443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.158438921 CEST60378443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.158514023 CEST60378443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.158550024 CEST4436037813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.160087109 CEST60384443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.160104036 CEST4436038413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.160193920 CEST60384443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.160264969 CEST60384443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.160269976 CEST4436038413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.521080971 CEST4436038013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.521711111 CEST4436038113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.522156000 CEST60380443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.522198915 CEST4436038013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.522207022 CEST60381443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.522284031 CEST4436038113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.522567987 CEST60380443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.522576094 CEST4436038013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.522603035 CEST60381443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.522617102 CEST4436038113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.562262058 CEST4436038213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.563065052 CEST60382443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.563139915 CEST4436038213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.563353062 CEST60382443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.563366890 CEST4436038213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.616998911 CEST4436038013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.617394924 CEST4436038113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.617468119 CEST4436038113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.617532015 CEST4436038013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.617568016 CEST4436038113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.617589951 CEST60381443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.617651939 CEST60380443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.617665052 CEST60381443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.617750883 CEST60380443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.617762089 CEST60381443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.617775917 CEST4436038013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.617799997 CEST4436038113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.617804050 CEST60380443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.617825031 CEST4436038013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.617854118 CEST60381443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.617870092 CEST4436038113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.620182037 CEST60385443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.620228052 CEST4436038513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.620269060 CEST60386443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.620285988 CEST4436038613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.620313883 CEST60385443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.620361090 CEST60386443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.620440960 CEST60385443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.620440960 CEST60386443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.620460987 CEST4436038513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.620480061 CEST4436038613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.659564018 CEST4436038213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.659636974 CEST4436038213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.659714937 CEST60382443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.660051107 CEST60382443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.660051107 CEST60382443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.660115004 CEST4436038213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.660151005 CEST4436038213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.662251949 CEST60387443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.662296057 CEST4436038713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.662473917 CEST60387443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.662473917 CEST60387443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.662507057 CEST4436038713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.693301916 CEST4436038313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.693682909 CEST60383443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.693706989 CEST4436038313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.694046021 CEST60383443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.694051981 CEST4436038313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.788325071 CEST4436038313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.788542032 CEST4436038313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.788690090 CEST60383443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.788866043 CEST60383443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.788866043 CEST60383443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.788887024 CEST4436038313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.788899899 CEST4436038313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.791482925 CEST60388443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.791574955 CEST4436038813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.791670084 CEST60388443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.791790962 CEST60388443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.791810036 CEST4436038813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.796842098 CEST4436038413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.797133923 CEST60384443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.797152996 CEST4436038413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.797635078 CEST60384443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.797641039 CEST4436038413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.897291899 CEST4436038413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.898268938 CEST4436038413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.898425102 CEST60384443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.898530006 CEST60384443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.898530960 CEST60384443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.898546934 CEST4436038413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.898557901 CEST4436038413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.900758982 CEST60389443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.900842905 CEST4436038913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:28.900957108 CEST60389443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.901071072 CEST60389443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:28.901093960 CEST4436038913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:29.466743946 CEST4436038713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:29.467327118 CEST60387443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:29.467359066 CEST4436038713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:29.467796087 CEST60387443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:29.467803955 CEST4436038713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:29.471165895 CEST4436038613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:29.471492052 CEST60386443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:29.471551895 CEST4436038613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:29.471847057 CEST60386443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:29.471863031 CEST4436038613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:29.472074032 CEST4436038513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:29.472542048 CEST60385443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:29.472599983 CEST4436038513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:29.472902060 CEST60385443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:29.472955942 CEST4436038513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:29.562061071 CEST4436038713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:29.562114954 CEST4436038713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:29.562158108 CEST4436038713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:29.562160969 CEST60387443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:29.562216043 CEST60387443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:29.562366009 CEST60387443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:29.562385082 CEST4436038713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:29.562397003 CEST60387443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:29.562403917 CEST4436038713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:29.565162897 CEST60390443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:29.565247059 CEST4436039013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:29.565337896 CEST60390443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:29.565457106 CEST60390443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:29.565491915 CEST4436039013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:29.565907955 CEST4436038613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:29.566080093 CEST4436038613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:29.566181898 CEST4436038613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:29.566251993 CEST60386443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:29.566251993 CEST60386443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:29.566251993 CEST60386443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:29.566251993 CEST60386443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:29.568032026 CEST60391443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:29.568124056 CEST4436039113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:29.568186045 CEST60391443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:29.569005966 CEST60391443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:29.569040060 CEST4436039113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:29.571541071 CEST4436038513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:29.571700096 CEST4436038513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:29.571917057 CEST60385443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:29.571917057 CEST60385443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:29.571917057 CEST60385443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:29.573585033 CEST60392443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:29.573667049 CEST4436039213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:29.573771000 CEST60392443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:29.573863029 CEST60392443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:29.573899031 CEST4436039213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:29.639952898 CEST4436038913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:29.640369892 CEST60389443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:29.640450954 CEST4436038913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:29.640747070 CEST60389443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:29.640799999 CEST4436038913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:29.642308950 CEST4436038813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:29.642594099 CEST60388443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:29.642671108 CEST4436038813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:29.642918110 CEST60388443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:29.642934084 CEST4436038813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:29.736183882 CEST4436038913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:29.736216068 CEST4436038913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:29.736258984 CEST4436038913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:29.736531019 CEST60389443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:29.736531973 CEST60389443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:29.747240067 CEST4436038813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:29.747442961 CEST4436038813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:29.747644901 CEST60388443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:29.749623060 CEST60389443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:29.749623060 CEST60389443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:29.749690056 CEST4436038913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:29.749723911 CEST4436038913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:29.750735044 CEST60388443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:29.750735998 CEST60388443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:29.750783920 CEST4436038813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:29.750813007 CEST4436038813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:29.753283024 CEST60393443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:29.753354073 CEST4436039313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:29.753426075 CEST60393443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:29.753827095 CEST60394443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:29.753846884 CEST4436039413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:29.753906012 CEST60394443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:29.753993988 CEST60393443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:29.754024982 CEST4436039313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:29.754101038 CEST60394443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:29.754117012 CEST4436039413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:29.865845919 CEST60386443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:29.865906954 CEST4436038613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:29.881326914 CEST60385443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:29.881390095 CEST4436038513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.181690931 CEST4436039113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.182404995 CEST4436039013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.183020115 CEST60391443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:30.183084011 CEST4436039113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.183393955 CEST60391443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:30.183408022 CEST4436039113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.183687925 CEST60390443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:30.183746099 CEST4436039013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.184206963 CEST60390443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:30.184262037 CEST4436039013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.197110891 CEST4436039213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.199048042 CEST60392443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:30.199105024 CEST4436039213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.199378014 CEST60392443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:30.199414015 CEST4436039213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.278206110 CEST4436039013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.278645039 CEST4436039013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.278877020 CEST60390443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:30.278877020 CEST60390443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:30.278956890 CEST60390443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:30.278994083 CEST4436039013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.281578064 CEST60395443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:30.281660080 CEST4436039513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.281748056 CEST60395443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:30.281846046 CEST60395443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:30.281872988 CEST4436039513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.292922020 CEST4436039213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.293062925 CEST4436039213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.293144941 CEST60392443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:30.293144941 CEST60392443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:30.293231964 CEST60392443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:30.293268919 CEST4436039213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.295262098 CEST60396443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:30.295344114 CEST4436039613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.295452118 CEST60396443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:30.295557022 CEST60396443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:30.295581102 CEST4436039613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.321052074 CEST4436039113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.321218014 CEST4436039113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.321392059 CEST60391443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:30.321767092 CEST60391443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:30.321767092 CEST60391443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:30.321834087 CEST4436039113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.321873903 CEST4436039113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.323491096 CEST60397443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:30.323574066 CEST4436039713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.323661089 CEST60397443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:30.323748112 CEST60397443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:30.323765993 CEST4436039713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.376518965 CEST4436039313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.377006054 CEST60393443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:30.377082109 CEST4436039313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.377367020 CEST60393443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:30.377378941 CEST4436039313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.388427019 CEST4436039413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.388700962 CEST60394443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:30.388729095 CEST4436039413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.389028072 CEST60394443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:30.389036894 CEST4436039413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.476608992 CEST4436039313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.476764917 CEST4436039313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.476950884 CEST60393443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:30.477006912 CEST60393443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:30.477006912 CEST60393443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:30.477044106 CEST4436039313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.477065086 CEST4436039313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.479301929 CEST60398443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:30.479408979 CEST4436039813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.479491949 CEST60398443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:30.479617119 CEST60398443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:30.479635000 CEST4436039813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.489320993 CEST4436039413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.489486933 CEST4436039413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.489540100 CEST4436039413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.489540100 CEST60394443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:30.489590883 CEST60394443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:30.489619017 CEST60394443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:30.489629984 CEST4436039413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.489674091 CEST60394443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:30.489686966 CEST4436039413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.491422892 CEST60399443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:30.491507053 CEST4436039913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.491590023 CEST60399443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:30.491687059 CEST60399443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:30.491708040 CEST4436039913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.935571909 CEST4436039613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.936508894 CEST60396443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:30.936566114 CEST4436039613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.936850071 CEST60396443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:30.936902046 CEST4436039613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.941423893 CEST4436039713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.941915035 CEST60397443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:30.941960096 CEST4436039713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.942111015 CEST60397443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:30.942123890 CEST4436039713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.953407049 CEST4436039513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.953747034 CEST60395443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:30.953804970 CEST4436039513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:30.954113960 CEST60395443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:30.954165936 CEST4436039513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:31.037538052 CEST4436039713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:31.037718058 CEST4436039713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:31.037982941 CEST60397443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:31.038115978 CEST60397443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:31.038115978 CEST60397443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:31.038167000 CEST4436039713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:31.038202047 CEST4436039713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:31.040862083 CEST60401443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:31.040950060 CEST4436040113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:31.041141033 CEST60401443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:31.041213036 CEST60401443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:31.041232109 CEST4436040113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:31.070904016 CEST4436039513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:31.071057081 CEST4436039513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:31.071322918 CEST60395443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:31.071445942 CEST60395443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:31.071446896 CEST60395443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:31.071490049 CEST4436039513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:31.071521997 CEST4436039513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:31.073338985 CEST60402443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:31.073424101 CEST4436040213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:31.073575974 CEST60402443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:31.073681116 CEST60402443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:31.073704004 CEST4436040213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:31.085095882 CEST4436039613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:31.085248947 CEST4436039613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:31.085357904 CEST60396443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:31.085690022 CEST60396443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:31.085690975 CEST60396443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:31.085756063 CEST4436039613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:31.085798979 CEST4436039613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:31.087327957 CEST60403443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:31.087439060 CEST4436040313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:31.087538958 CEST60403443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:31.087651968 CEST60403443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:31.087676048 CEST4436040313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:31.104000092 CEST4436039913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:31.104522943 CEST60399443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:31.104600906 CEST4436039913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:31.104779005 CEST60399443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:31.104792118 CEST4436039913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:31.105005026 CEST4436039813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:31.105248928 CEST60398443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:31.105305910 CEST4436039813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:31.105542898 CEST60398443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:31.105556965 CEST4436039813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:31.201021910 CEST4436039913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:31.201159954 CEST4436039913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:31.201435089 CEST60399443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:31.201435089 CEST60399443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:31.201436043 CEST60399443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:31.202528000 CEST4436039813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:31.202683926 CEST4436039813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:31.202769041 CEST60398443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:31.202769041 CEST60398443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:31.202769041 CEST60398443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:31.203902006 CEST60404443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:31.203986883 CEST4436040413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:31.204111099 CEST60404443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:31.204221010 CEST60404443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:31.204247952 CEST4436040413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:31.204478979 CEST60405443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:31.204526901 CEST4436040513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:31.204684973 CEST60405443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:31.204684973 CEST60405443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:31.204727888 CEST4436040513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:31.507019997 CEST60398443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:31.507086992 CEST4436039813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:31.507117987 CEST60399443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:31.507179022 CEST4436039913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:32.695199966 CEST4436040113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:32.695844889 CEST60401443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:32.695924997 CEST4436040113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:32.696194887 CEST4436040313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:32.696218967 CEST4436040213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:32.696285963 CEST60401443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:32.696300030 CEST4436040113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:32.696645021 CEST60403443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:32.696703911 CEST4436040313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:32.696829081 CEST60403443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:32.696845055 CEST4436040313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:32.696974993 CEST60402443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:32.696989059 CEST4436040213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:32.697268963 CEST60402443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:32.697279930 CEST4436040213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:32.792160034 CEST4436040113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:32.792891979 CEST4436040113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:32.793000937 CEST60401443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:32.793000937 CEST60401443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:32.793077946 CEST60401443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:32.793118000 CEST4436040113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:32.793170929 CEST4436040313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:32.793327093 CEST4436040313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:32.795506954 CEST60406443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:32.795552969 CEST4436040613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:32.795635939 CEST60406443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:32.795697927 CEST60403443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:32.795697927 CEST60403443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:32.795747042 CEST60406443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:32.795758009 CEST4436040613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:32.795789957 CEST60403443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:32.795826912 CEST4436040313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:32.797494888 CEST60407443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:32.797576904 CEST4436040713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:32.797642946 CEST4436040213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:32.797663927 CEST60407443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:32.797800064 CEST60407443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:32.797821999 CEST4436040713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:32.799618959 CEST4436040213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:32.799685955 CEST60402443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:32.799709082 CEST4436040213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:32.799801111 CEST60402443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:32.799801111 CEST60402443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:32.799818039 CEST4436040213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:32.800096989 CEST4436040213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:32.801426888 CEST60408443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:32.801512957 CEST4436040813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:32.801594973 CEST60408443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:32.801707983 CEST60408443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:32.801738977 CEST4436040813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:32.860088110 CEST4436040413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:32.860796928 CEST60404443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:32.860882998 CEST4436040413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:32.861150980 CEST60404443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:32.861166954 CEST4436040413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:32.880579948 CEST4436040513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:32.880860090 CEST60405443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:32.880886078 CEST4436040513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:32.881201982 CEST60405443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:32.881207943 CEST4436040513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:32.958056927 CEST4436040413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:32.958131075 CEST4436040413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:32.958236933 CEST4436040413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:32.958487034 CEST60404443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:32.958487034 CEST60404443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:32.958602905 CEST60404443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:32.958602905 CEST60404443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:32.958643913 CEST4436040413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:32.958677053 CEST4436040413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:32.961214066 CEST60409443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:32.961296082 CEST4436040913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:32.961386919 CEST60409443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:32.961508989 CEST60409443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:32.961532116 CEST4436040913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:32.989121914 CEST4436040513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:32.989190102 CEST4436040513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:32.989408016 CEST60405443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:32.989690065 CEST60405443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:32.989690065 CEST60405443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:32.989712954 CEST4436040513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:32.989726067 CEST4436040513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:32.991727114 CEST60410443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:32.991808891 CEST4436041013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:32.991928101 CEST60410443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:32.992006063 CEST60410443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:32.992027044 CEST4436041013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:33.493582964 CEST4436040813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:33.494051933 CEST60408443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:33.494111061 CEST4436040813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:33.494494915 CEST60408443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:33.494509935 CEST4436040813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:33.495196104 CEST4436040613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:33.495435953 CEST60406443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:33.495460987 CEST4436040613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:33.495716095 CEST60406443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:33.495723009 CEST4436040613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:33.585566044 CEST4436040913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:33.586132050 CEST60409443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:33.586191893 CEST4436040913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:33.586457968 CEST60409443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:33.586473942 CEST4436040913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:33.588032961 CEST4436040813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:33.588293076 CEST4436040813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:33.588377953 CEST60408443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:33.588463068 CEST60408443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:33.588463068 CEST60408443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:33.588506937 CEST4436040813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:33.588532925 CEST4436040813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:33.589940071 CEST4436040613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:33.590004921 CEST4436040613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:33.590059042 CEST60406443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:33.590079069 CEST4436040613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:33.590107918 CEST4436040613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:33.590152979 CEST60406443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:33.590194941 CEST60406443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:33.590214014 CEST4436040613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:33.590225935 CEST60406443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:33.590233088 CEST4436040613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:33.590770006 CEST60411443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:33.590816021 CEST4436041113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:33.590882063 CEST60411443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:33.591008902 CEST60411443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:33.591037035 CEST4436041113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:33.592015028 CEST60412443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:33.592097044 CEST4436041213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:33.592190981 CEST60412443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:33.592284918 CEST60412443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:33.592309952 CEST4436041213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:33.601032972 CEST4436041013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:33.601330996 CEST60410443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:33.601361036 CEST4436041013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:33.601687908 CEST60410443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:33.601697922 CEST4436041013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:33.679919004 CEST4436040913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:33.680066109 CEST4436040913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:33.680286884 CEST60409443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:33.680288076 CEST60409443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:33.680382013 CEST60409443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:33.680421114 CEST4436040913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:33.681952000 CEST60413443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:33.682034969 CEST4436041313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:33.682121992 CEST60413443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:33.682214975 CEST60413443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:33.682235956 CEST4436041313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:33.696433067 CEST4436041013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:33.698107958 CEST4436041013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:33.698178053 CEST4436041013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:33.698281050 CEST60410443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:33.698281050 CEST60410443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:33.698281050 CEST60410443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:33.698281050 CEST60410443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:33.699994087 CEST60414443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:33.700033903 CEST4436041413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:33.700105906 CEST60414443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:33.700208902 CEST60414443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:33.700232029 CEST4436041413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:34.005153894 CEST60410443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:34.005215883 CEST4436041013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:34.206439018 CEST4436041113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:34.207190037 CEST60411443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:34.207267046 CEST4436041113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:34.207628965 CEST60411443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:34.207643032 CEST4436041113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:34.260467052 CEST4436041213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:34.260981083 CEST60412443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:34.261034966 CEST4436041213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:34.261470079 CEST60412443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:34.261482000 CEST4436041213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:34.301286936 CEST4436041113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:34.301434994 CEST4436041113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:34.301701069 CEST60411443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:34.301791906 CEST60411443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:34.301791906 CEST60411443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:34.301836967 CEST4436041113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:34.301867962 CEST4436041113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:34.304675102 CEST60415443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:34.304748058 CEST4436041513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:34.304971933 CEST60415443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:34.304971933 CEST60415443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:34.305037975 CEST4436041513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:34.311789989 CEST4436041313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:34.312160015 CEST60413443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:34.312201977 CEST4436041313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:34.312494040 CEST60413443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:34.312501907 CEST4436041313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:34.337622881 CEST4436041413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:34.338165998 CEST60414443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:34.338242054 CEST4436041413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:34.338500977 CEST60414443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:34.338553905 CEST4436041413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:34.364911079 CEST4436041213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:34.365092039 CEST4436041213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:34.365173101 CEST60412443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:34.365340948 CEST60412443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:34.365340948 CEST60412443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:34.365385056 CEST4436041213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:34.365411043 CEST4436041213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:34.367433071 CEST60416443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:34.367516041 CEST4436041613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:34.367769957 CEST60416443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:34.367769957 CEST60416443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:34.367898941 CEST4436041613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:34.407987118 CEST4436041313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:34.408023119 CEST4436041313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:34.408093929 CEST4436041313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:34.408159018 CEST60413443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:34.408159018 CEST60413443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:34.408392906 CEST60413443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:34.408394098 CEST60413443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:34.408425093 CEST4436041313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:34.408442020 CEST4436041313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:34.410094976 CEST60417443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:34.410130024 CEST4436041713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:34.410188913 CEST60417443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:34.410312891 CEST60417443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:34.410321951 CEST4436041713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:34.436501980 CEST4436041413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:34.436652899 CEST4436041413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:34.436832905 CEST60414443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:34.436832905 CEST60414443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:34.436832905 CEST60414443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:34.438551903 CEST60418443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:34.438565969 CEST4436041813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:34.438620090 CEST60418443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:34.438775063 CEST60418443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:34.438785076 CEST4436041813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:34.741333961 CEST60414443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:34.741394997 CEST4436041413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:34.917550087 CEST4436041513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:34.921372890 CEST60415443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:34.921421051 CEST4436041513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:34.921803951 CEST60415443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:34.921817064 CEST4436041513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.006174088 CEST4436041613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.009393930 CEST60416443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.009452105 CEST4436041613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.009887934 CEST60416443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.009977102 CEST4436041613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.012851954 CEST4436041513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.012908936 CEST4436041513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.012981892 CEST60415443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.013016939 CEST4436041513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.013168097 CEST60415443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.013168097 CEST60415443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.013190985 CEST4436041513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.013247013 CEST4436041513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.015516043 CEST60419443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.015573025 CEST4436041913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.015661955 CEST60419443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.015767097 CEST60419443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.015788078 CEST4436041913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.075592041 CEST4436041813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.075696945 CEST4436041713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.075910091 CEST60418443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.075925112 CEST4436041813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.076186895 CEST60417443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.076193094 CEST4436041713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.076276064 CEST60418443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.076281071 CEST4436041813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.076564074 CEST60417443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.076567888 CEST4436041713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.106034994 CEST4436041613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.106085062 CEST4436041613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.106240034 CEST60416443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.106260061 CEST4436041613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.106318951 CEST60416443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.106369972 CEST60416443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.106369972 CEST60416443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.106411934 CEST4436041613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.106439114 CEST4436041613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.108454943 CEST60420443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.108539104 CEST4436042013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.108650923 CEST60420443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.108743906 CEST60420443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.108767986 CEST4436042013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.170871973 CEST4436041813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.170928955 CEST4436041813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.171086073 CEST60418443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.171093941 CEST4436041813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.171169996 CEST60418443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.171175003 CEST4436041813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.171202898 CEST60418443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.171257973 CEST4436041813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.173005104 CEST60421443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.173094034 CEST4436042113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.173182964 CEST60421443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.173289061 CEST60421443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.173312902 CEST4436042113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.174922943 CEST4436041713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.174977064 CEST4436041713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.175069094 CEST60417443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.175074100 CEST4436041713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.175102949 CEST4436041713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.175146103 CEST60417443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.175159931 CEST4436041713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.175167084 CEST60417443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.175167084 CEST60417443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.175173044 CEST4436041713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.175177097 CEST4436041713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.177314997 CEST60422443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.177337885 CEST4436042213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.177499056 CEST60422443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.177499056 CEST60422443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.177548885 CEST4436042213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.179205894 CEST4436040713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.179534912 CEST60407443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.179563999 CEST4436040713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.179884911 CEST60407443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.179893017 CEST4436040713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.279154062 CEST4436040713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.279325962 CEST4436040713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.279491901 CEST60407443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.279824018 CEST60407443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.279824018 CEST60407443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.279890060 CEST4436040713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.279927015 CEST4436040713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.282273054 CEST60423443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.282356024 CEST4436042313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.282452106 CEST60423443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.282583952 CEST60423443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.282608032 CEST4436042313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.641011953 CEST4436041913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.641680002 CEST60419443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.641762018 CEST4436041913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.642055988 CEST60419443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.642108917 CEST4436041913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.738380909 CEST4436041913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.738519907 CEST4436041913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.738923073 CEST60419443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.738923073 CEST60419443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.738923073 CEST60419443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.741558075 CEST60424443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.741631031 CEST4436042413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.741745949 CEST60424443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.741889000 CEST60424443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.741904974 CEST4436042413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.760504961 CEST4436042013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.760988951 CEST60420443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.761070013 CEST4436042013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.761425018 CEST60420443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.761478901 CEST4436042013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.787564993 CEST4436042113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.787992001 CEST60421443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.788077116 CEST4436042113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.788201094 CEST60421443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.788218021 CEST4436042113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.805378914 CEST4436042213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.805814981 CEST60422443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.805900097 CEST4436042213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.806010962 CEST60422443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.806025982 CEST4436042213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.872626066 CEST4436042013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.872776031 CEST4436042013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.872906923 CEST60420443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.872906923 CEST60420443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.872988939 CEST60420443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.873025894 CEST4436042013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.875447989 CEST60425443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.875530005 CEST4436042513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.875629902 CEST60425443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.875947952 CEST60425443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.876027107 CEST4436042513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.882426977 CEST4436042113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.882577896 CEST4436042113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.882752895 CEST60421443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.882752895 CEST60421443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.882752895 CEST60421443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.884481907 CEST60426443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.884563923 CEST4436042613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.884649038 CEST60426443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.884743929 CEST60426443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.884766102 CEST4436042613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.894367933 CEST4436042313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.894854069 CEST60423443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.894942045 CEST4436042313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.895210981 CEST60423443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.895265102 CEST4436042313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.902581930 CEST4436042213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.903068066 CEST4436042213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.903223038 CEST60422443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.903223038 CEST60422443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.903223038 CEST60422443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.904912949 CEST60427443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.904966116 CEST4436042713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.905044079 CEST60427443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.905152082 CEST60427443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.905165911 CEST4436042713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.989444017 CEST4436042313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.989492893 CEST4436042313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.989708900 CEST60423443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.989747047 CEST4436042313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.990048885 CEST60423443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.990048885 CEST60423443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.990048885 CEST60423443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.992760897 CEST60428443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.992826939 CEST4436042813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:35.992928982 CEST60428443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.993074894 CEST60428443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:35.993089914 CEST4436042813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:36.037415981 CEST60419443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:36.037476063 CEST4436041913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:36.193448067 CEST60421443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:36.193511009 CEST4436042113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:36.209302902 CEST60422443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:36.209366083 CEST4436042213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:36.302911997 CEST60423443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:36.302973032 CEST4436042313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:36.371680021 CEST4436042413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:36.372148991 CEST60424443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:36.372201920 CEST4436042413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:36.372598886 CEST60424443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:36.372611046 CEST4436042413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:36.481091022 CEST4436042413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:36.481170893 CEST4436042413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:36.481246948 CEST60424443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:36.481277943 CEST4436042413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:36.481327057 CEST4436042413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:36.481394053 CEST60424443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:36.481543064 CEST60424443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:36.481543064 CEST60424443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:36.481578112 CEST4436042413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:36.481600046 CEST4436042413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:36.484286070 CEST60429443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:36.484369040 CEST4436042913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:36.484462976 CEST60429443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:36.484730005 CEST60429443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:36.484790087 CEST4436042913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:36.502974033 CEST4436042613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:36.503556013 CEST60426443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:36.503613949 CEST4436042613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:36.503968954 CEST60426443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:36.503982067 CEST4436042613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:36.506695032 CEST4436042513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:36.506968021 CEST60425443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:36.506997108 CEST4436042513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:36.507272005 CEST60425443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:36.507282972 CEST4436042513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:36.558007002 CEST4436042813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:36.558506012 CEST60428443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:36.558563948 CEST4436042813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:36.558832884 CEST60428443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:36.558849096 CEST4436042813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:36.597882986 CEST4436042613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:36.597940922 CEST4436042613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:36.598067045 CEST4436042613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:36.598130941 CEST60426443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:36.598282099 CEST60426443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:36.598282099 CEST60426443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:36.598283052 CEST60426443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:36.603251934 CEST60430443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:36.603334904 CEST4436043013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:36.603420019 CEST60430443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:36.603539944 CEST60430443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:36.603559971 CEST4436043013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:36.603794098 CEST4436042513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:36.603852987 CEST4436042513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:36.603905916 CEST4436042513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:36.603935957 CEST60425443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:36.603976011 CEST4436042513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:36.604007959 CEST60425443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:36.604034901 CEST60425443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:36.664237976 CEST4436042813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:36.664311886 CEST4436042813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:36.664509058 CEST60428443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:36.664546013 CEST4436042813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:36.664614916 CEST60428443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:36.664653063 CEST4436042813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:36.664777040 CEST60428443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:36.664798021 CEST4436042813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:36.664819956 CEST60428443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:36.664823055 CEST4436042813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:36.664848089 CEST4436042813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:36.667288065 CEST60431443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:36.667331934 CEST4436043113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:36.667423964 CEST60431443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:36.667535067 CEST60431443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:36.667551041 CEST4436043113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:36.684777975 CEST4436042513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:36.684931040 CEST4436042513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:36.685107946 CEST60425443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:36.685107946 CEST60425443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:36.685107946 CEST60425443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:36.685107946 CEST60425443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:36.685209036 CEST4436042513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:36.686969995 CEST60432443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:36.687057972 CEST4436043213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:36.688946009 CEST60432443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:36.689040899 CEST60432443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:36.689059019 CEST4436043213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:36.912587881 CEST60426443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:36.912648916 CEST4436042613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:36.990432024 CEST60425443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:36.990494013 CEST4436042513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.004698038 CEST4436042713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.027532101 CEST60427443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.027564049 CEST4436042713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.027949095 CEST60427443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.027960062 CEST4436042713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.101808071 CEST4436042913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.102300882 CEST60429443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.102382898 CEST4436042913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.102673054 CEST60429443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.102725983 CEST4436042913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.129833937 CEST4436042713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.129889011 CEST4436042713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.129967928 CEST60427443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.129991055 CEST4436042713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.130064011 CEST60427443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.200138092 CEST4436042913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.200190067 CEST4436042913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.200335979 CEST4436042913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.200398922 CEST60429443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.200398922 CEST60429443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.200485945 CEST60429443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.200485945 CEST60429443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.200526953 CEST4436042913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.200557947 CEST4436042913.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.203083038 CEST60433443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.203166008 CEST4436043313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.203260899 CEST60433443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.203413010 CEST60433443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.203433990 CEST4436043313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.212349892 CEST4436042713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.212455988 CEST60427443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.212477922 CEST4436042713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.212524891 CEST4436042713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.212549925 CEST60427443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.212574959 CEST60427443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.212605953 CEST60427443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.212605953 CEST60427443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.212632895 CEST4436042713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.212652922 CEST4436042713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.214526892 CEST60434443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.214608908 CEST4436043413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.214704037 CEST60434443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.214797020 CEST60434443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.214814901 CEST4436043413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.255832911 CEST4436043013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.257067919 CEST60430443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.257126093 CEST4436043013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.257422924 CEST60430443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.257476091 CEST4436043013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.332231998 CEST4436043113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.332617998 CEST60431443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.332662106 CEST4436043113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.333025932 CEST60431443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.333044052 CEST4436043113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.345447063 CEST4436043213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.345726967 CEST60432443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.345787048 CEST4436043213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.346013069 CEST60432443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.346026897 CEST4436043213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.351946115 CEST4436043013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.352303028 CEST4436043013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.352488041 CEST60430443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.352488041 CEST60430443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.352488041 CEST60430443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.354199886 CEST60435443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.354254007 CEST4436043513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.354331017 CEST60435443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.354681015 CEST60435443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.354700089 CEST4436043513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.432116985 CEST4436043113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.432250977 CEST4436043113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.432317019 CEST60431443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.432421923 CEST60431443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.432468891 CEST4436043113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.432498932 CEST60431443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.432514906 CEST4436043113.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.434945107 CEST60436443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.434979916 CEST4436043613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.435040951 CEST60436443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.435164928 CEST60436443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.435168982 CEST4436043613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.441432953 CEST4436043213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.441839933 CEST4436043213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.441895962 CEST60432443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.441976070 CEST60432443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.441976070 CEST60432443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.442018032 CEST4436043213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.442047119 CEST4436043213.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.444890976 CEST60437443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.444976091 CEST4436043713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.445059061 CEST60437443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.445152998 CEST60437443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.445179939 CEST4436043713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.662643909 CEST60430443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.662704945 CEST4436043013.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.842116117 CEST4436043413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.842672110 CEST60434443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.842756033 CEST4436043413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.843080997 CEST60434443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.843096018 CEST4436043413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.845802069 CEST4436043313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.846035004 CEST60433443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.846061945 CEST4436043313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.846425056 CEST60433443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.846478939 CEST4436043313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.938150883 CEST4436043413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.938880920 CEST4436043413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.938985109 CEST4436043413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.939042091 CEST60434443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.939042091 CEST60434443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.939127922 CEST60434443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.939127922 CEST60434443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.939168930 CEST4436043413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.939198971 CEST4436043413.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.941538095 CEST60438443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.941622972 CEST4436043813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.941739082 CEST60438443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.941874981 CEST60438443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.941906929 CEST4436043813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.944952011 CEST4436043313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.945144892 CEST4436043313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.945220947 CEST60433443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.945300102 CEST60433443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.945301056 CEST60433443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.945342064 CEST4436043313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.945374012 CEST4436043313.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.979310036 CEST4436043513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.979773045 CEST60435443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.979856014 CEST4436043513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:37.980012894 CEST60435443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:37.980030060 CEST4436043513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:38.078540087 CEST4436043513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:38.078679085 CEST4436043513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:38.078898907 CEST60435443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:38.078898907 CEST60435443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:38.078898907 CEST60435443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:38.086900949 CEST4436043713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:38.087387085 CEST60437443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:38.087467909 CEST4436043713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:38.087699890 CEST4436043613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:38.087759018 CEST60437443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:38.087812901 CEST4436043713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:38.087919950 CEST60436443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:38.087944031 CEST4436043613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:38.088165998 CEST60436443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:38.088171005 CEST4436043613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:38.186180115 CEST4436043713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:38.186331987 CEST4436043713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:38.186522961 CEST60437443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:38.186522961 CEST60437443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:38.186522961 CEST60437443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:38.222887039 CEST4436043613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:38.223030090 CEST4436043613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:38.223093033 CEST60436443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:38.223139048 CEST60436443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:38.223156929 CEST4436043613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:38.223169088 CEST60436443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:38.223174095 CEST4436043613.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:38.381417990 CEST60435443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:38.381479979 CEST4436043513.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:38.490607977 CEST60437443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:38.490668058 CEST4436043713.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:38.575382948 CEST4436043813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:38.576122046 CEST60438443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:38.576205969 CEST4436043813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:38.576662064 CEST60438443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:38.576714993 CEST4436043813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:38.671313047 CEST4436043813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:38.671488047 CEST4436043813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:38.671799898 CEST60438443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:38.671799898 CEST60438443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:38.671799898 CEST60438443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:38.975184917 CEST60438443192.168.2.413.107.246.60
                                                        Oct 7, 2024 20:47:38.975244045 CEST4436043813.107.246.60192.168.2.4
                                                        Oct 7, 2024 20:47:45.806358099 CEST60235443192.168.2.4142.250.185.132
                                                        Oct 7, 2024 20:47:45.806427002 CEST44360235142.250.185.132192.168.2.4
                                                        Oct 7, 2024 20:47:45.806652069 CEST60439443192.168.2.4142.250.186.78
                                                        Oct 7, 2024 20:47:45.806742907 CEST44360439142.250.186.78192.168.2.4
                                                        Oct 7, 2024 20:47:45.808360100 CEST60439443192.168.2.4142.250.186.78
                                                        Oct 7, 2024 20:47:45.808509111 CEST60439443192.168.2.4142.250.186.78
                                                        Oct 7, 2024 20:47:45.808541059 CEST44360439142.250.186.78192.168.2.4
                                                        Oct 7, 2024 20:47:45.944881916 CEST60440443192.168.2.4142.250.186.78
                                                        Oct 7, 2024 20:47:45.944969893 CEST44360440142.250.186.78192.168.2.4
                                                        Oct 7, 2024 20:47:45.945060968 CEST60440443192.168.2.4142.250.186.78
                                                        Oct 7, 2024 20:47:45.945218086 CEST60440443192.168.2.4142.250.186.78
                                                        Oct 7, 2024 20:47:45.945239067 CEST44360440142.250.186.78192.168.2.4
                                                        Oct 7, 2024 20:47:46.455854893 CEST44360439142.250.186.78192.168.2.4
                                                        Oct 7, 2024 20:47:46.456276894 CEST60439443192.168.2.4142.250.186.78
                                                        Oct 7, 2024 20:47:46.456342936 CEST44360439142.250.186.78192.168.2.4
                                                        Oct 7, 2024 20:47:46.456877947 CEST44360439142.250.186.78192.168.2.4
                                                        Oct 7, 2024 20:47:46.457403898 CEST60439443192.168.2.4142.250.186.78
                                                        Oct 7, 2024 20:47:46.457403898 CEST60439443192.168.2.4142.250.186.78
                                                        Oct 7, 2024 20:47:46.457405090 CEST60439443192.168.2.4142.250.186.78
                                                        Oct 7, 2024 20:47:46.457509995 CEST44360439142.250.186.78192.168.2.4
                                                        Oct 7, 2024 20:47:46.457592964 CEST44360439142.250.186.78192.168.2.4
                                                        Oct 7, 2024 20:47:46.506556988 CEST60439443192.168.2.4142.250.186.78
                                                        Oct 7, 2024 20:47:46.592300892 CEST44360440142.250.186.78192.168.2.4
                                                        Oct 7, 2024 20:47:46.592540026 CEST60440443192.168.2.4142.250.186.78
                                                        Oct 7, 2024 20:47:46.592571020 CEST44360440142.250.186.78192.168.2.4
                                                        Oct 7, 2024 20:47:46.593775988 CEST44360440142.250.186.78192.168.2.4
                                                        Oct 7, 2024 20:47:46.594080925 CEST60440443192.168.2.4142.250.186.78
                                                        Oct 7, 2024 20:47:46.594182014 CEST44360440142.250.186.78192.168.2.4
                                                        Oct 7, 2024 20:47:46.594217062 CEST60440443192.168.2.4142.250.186.78
                                                        Oct 7, 2024 20:47:46.594276905 CEST60440443192.168.2.4142.250.186.78
                                                        Oct 7, 2024 20:47:46.594295025 CEST44360440142.250.186.78192.168.2.4
                                                        Oct 7, 2024 20:47:46.755372047 CEST44360439142.250.186.78192.168.2.4
                                                        Oct 7, 2024 20:47:46.756705046 CEST44360439142.250.186.78192.168.2.4
                                                        Oct 7, 2024 20:47:46.756874084 CEST60439443192.168.2.4142.250.186.78
                                                        Oct 7, 2024 20:47:46.756958961 CEST60439443192.168.2.4142.250.186.78
                                                        Oct 7, 2024 20:47:46.756999969 CEST44360439142.250.186.78192.168.2.4
                                                        Oct 7, 2024 20:47:46.881021976 CEST44360440142.250.186.78192.168.2.4
                                                        Oct 7, 2024 20:47:46.882230997 CEST44360440142.250.186.78192.168.2.4
                                                        Oct 7, 2024 20:47:46.882430077 CEST60440443192.168.2.4142.250.186.78
                                                        Oct 7, 2024 20:47:46.882669926 CEST60440443192.168.2.4142.250.186.78
                                                        Oct 7, 2024 20:47:46.882713079 CEST44360440142.250.186.78192.168.2.4

                                                        UDP Packets

                                                        TimestampSource PortDest PortSource IPDest IP
                                                        Oct 7, 2024 20:46:01.176422119 CEST6524153192.168.2.41.1.1.1
                                                        Oct 7, 2024 20:46:01.176747084 CEST5598953192.168.2.41.1.1.1
                                                        Oct 7, 2024 20:46:01.184545040 CEST53559891.1.1.1192.168.2.4
                                                        Oct 7, 2024 20:46:01.184581995 CEST53652411.1.1.1192.168.2.4
                                                        Oct 7, 2024 20:46:01.198060989 CEST53507871.1.1.1192.168.2.4
                                                        Oct 7, 2024 20:46:01.221546888 CEST53596341.1.1.1192.168.2.4
                                                        Oct 7, 2024 20:46:02.325747967 CEST6399653192.168.2.41.1.1.1
                                                        Oct 7, 2024 20:46:02.325913906 CEST5470553192.168.2.41.1.1.1
                                                        Oct 7, 2024 20:46:02.333398104 CEST53639961.1.1.1192.168.2.4
                                                        Oct 7, 2024 20:46:02.334083080 CEST53547051.1.1.1192.168.2.4
                                                        Oct 7, 2024 20:46:02.357863903 CEST53555751.1.1.1192.168.2.4
                                                        Oct 7, 2024 20:46:05.584583044 CEST6544153192.168.2.41.1.1.1
                                                        Oct 7, 2024 20:46:05.584728003 CEST5038053192.168.2.41.1.1.1
                                                        Oct 7, 2024 20:46:05.604778051 CEST53654411.1.1.1192.168.2.4
                                                        Oct 7, 2024 20:46:05.604821920 CEST53503801.1.1.1192.168.2.4
                                                        Oct 7, 2024 20:46:07.669178963 CEST53555891.1.1.1192.168.2.4
                                                        Oct 7, 2024 20:46:10.295494080 CEST6217253192.168.2.41.1.1.1
                                                        Oct 7, 2024 20:46:10.295623064 CEST5827453192.168.2.41.1.1.1
                                                        Oct 7, 2024 20:46:10.303683996 CEST53582741.1.1.1192.168.2.4
                                                        Oct 7, 2024 20:46:10.305794001 CEST53621721.1.1.1192.168.2.4
                                                        Oct 7, 2024 20:46:11.350646973 CEST6511453192.168.2.41.1.1.1
                                                        Oct 7, 2024 20:46:11.351116896 CEST5234253192.168.2.41.1.1.1
                                                        Oct 7, 2024 20:46:11.358124018 CEST53651141.1.1.1192.168.2.4
                                                        Oct 7, 2024 20:46:11.360132933 CEST53523421.1.1.1192.168.2.4
                                                        Oct 7, 2024 20:46:13.561408997 CEST53639941.1.1.1192.168.2.4
                                                        Oct 7, 2024 20:46:19.129698992 CEST138138192.168.2.4192.168.2.255
                                                        Oct 7, 2024 20:46:19.328419924 CEST53560211.1.1.1192.168.2.4
                                                        Oct 7, 2024 20:46:23.374214888 CEST53493631.1.1.1192.168.2.4
                                                        Oct 7, 2024 20:47:00.845659018 CEST53503731.1.1.1192.168.2.4
                                                        Oct 7, 2024 20:47:12.457091093 CEST53592611.1.1.1192.168.2.4
                                                        Oct 7, 2024 20:47:14.165755987 CEST6418053192.168.2.41.1.1.1
                                                        Oct 7, 2024 20:47:14.165877104 CEST6074353192.168.2.41.1.1.1
                                                        Oct 7, 2024 20:47:14.173371077 CEST53607431.1.1.1192.168.2.4
                                                        Oct 7, 2024 20:47:14.173810005 CEST53641801.1.1.1192.168.2.4

                                                        DNS Queries

                                                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                        Oct 7, 2024 20:46:01.176422119 CEST192.168.2.41.1.1.10x3bebStandard query (0)youtube.comA (IP address)IN (0x0001)false
                                                        Oct 7, 2024 20:46:01.176747084 CEST192.168.2.41.1.1.10xb476Standard query (0)youtube.com65IN (0x0001)false
                                                        Oct 7, 2024 20:46:02.325747967 CEST192.168.2.41.1.1.10xb226Standard query (0)www.youtube.comA (IP address)IN (0x0001)false
                                                        Oct 7, 2024 20:46:02.325913906 CEST192.168.2.41.1.1.10x1377Standard query (0)www.youtube.com65IN (0x0001)false
                                                        Oct 7, 2024 20:46:05.584583044 CEST192.168.2.41.1.1.10x969cStandard query (0)www.google.comA (IP address)IN (0x0001)false
                                                        Oct 7, 2024 20:46:05.584728003 CEST192.168.2.41.1.1.10xdba0Standard query (0)www.google.com65IN (0x0001)false
                                                        Oct 7, 2024 20:46:10.295494080 CEST192.168.2.41.1.1.10xc76aStandard query (0)accounts.youtube.comA (IP address)IN (0x0001)false
                                                        Oct 7, 2024 20:46:10.295623064 CEST192.168.2.41.1.1.10x64bcStandard query (0)accounts.youtube.com65IN (0x0001)false
                                                        Oct 7, 2024 20:46:11.350646973 CEST192.168.2.41.1.1.10xa670Standard query (0)play.google.comA (IP address)IN (0x0001)false
                                                        Oct 7, 2024 20:46:11.351116896 CEST192.168.2.41.1.1.10xa227Standard query (0)play.google.com65IN (0x0001)false
                                                        Oct 7, 2024 20:47:14.165755987 CEST192.168.2.41.1.1.10x5d0fStandard query (0)play.google.comA (IP address)IN (0x0001)false
                                                        Oct 7, 2024 20:47:14.165877104 CEST192.168.2.41.1.1.10x751dStandard query (0)play.google.com65IN (0x0001)false

                                                        DNS Answers

                                                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                        Oct 7, 2024 20:46:01.184545040 CEST1.1.1.1192.168.2.40xb476No error (0)youtube.com65IN (0x0001)false
                                                        Oct 7, 2024 20:46:01.184581995 CEST1.1.1.1192.168.2.40x3bebNo error (0)youtube.com142.250.184.238A (IP address)IN (0x0001)false
                                                        Oct 7, 2024 20:46:02.333398104 CEST1.1.1.1192.168.2.40xb226No error (0)www.youtube.comyoutube-ui.l.google.comCNAME (Canonical name)IN (0x0001)false
                                                        Oct 7, 2024 20:46:02.333398104 CEST1.1.1.1192.168.2.40xb226No error (0)youtube-ui.l.google.com142.250.185.174A (IP address)IN (0x0001)false
                                                        Oct 7, 2024 20:46:02.333398104 CEST1.1.1.1192.168.2.40xb226No error (0)youtube-ui.l.google.com216.58.206.78A (IP address)IN (0x0001)false
                                                        Oct 7, 2024 20:46:02.333398104 CEST1.1.1.1192.168.2.40xb226No error (0)youtube-ui.l.google.com142.250.184.238A (IP address)IN (0x0001)false
                                                        Oct 7, 2024 20:46:02.333398104 CEST1.1.1.1192.168.2.40xb226No error (0)youtube-ui.l.google.com142.250.181.238A (IP address)IN (0x0001)false
                                                        Oct 7, 2024 20:46:02.333398104 CEST1.1.1.1192.168.2.40xb226No error (0)youtube-ui.l.google.com216.58.206.46A (IP address)IN (0x0001)false
                                                        Oct 7, 2024 20:46:02.333398104 CEST1.1.1.1192.168.2.40xb226No error (0)youtube-ui.l.google.com142.250.185.78A (IP address)IN (0x0001)false
                                                        Oct 7, 2024 20:46:02.333398104 CEST1.1.1.1192.168.2.40xb226No error (0)youtube-ui.l.google.com142.250.185.206A (IP address)IN (0x0001)false
                                                        Oct 7, 2024 20:46:02.333398104 CEST1.1.1.1192.168.2.40xb226No error (0)youtube-ui.l.google.com142.250.185.238A (IP address)IN (0x0001)false
                                                        Oct 7, 2024 20:46:02.333398104 CEST1.1.1.1192.168.2.40xb226No error (0)youtube-ui.l.google.com172.217.18.14A (IP address)IN (0x0001)false
                                                        Oct 7, 2024 20:46:02.333398104 CEST1.1.1.1192.168.2.40xb226No error (0)youtube-ui.l.google.com142.250.185.110A (IP address)IN (0x0001)false
                                                        Oct 7, 2024 20:46:02.333398104 CEST1.1.1.1192.168.2.40xb226No error (0)youtube-ui.l.google.com142.250.186.142A (IP address)IN (0x0001)false
                                                        Oct 7, 2024 20:46:02.333398104 CEST1.1.1.1192.168.2.40xb226No error (0)youtube-ui.l.google.com142.250.186.78A (IP address)IN (0x0001)false
                                                        Oct 7, 2024 20:46:02.333398104 CEST1.1.1.1192.168.2.40xb226No error (0)youtube-ui.l.google.com142.250.186.174A (IP address)IN (0x0001)false
                                                        Oct 7, 2024 20:46:02.333398104 CEST1.1.1.1192.168.2.40xb226No error (0)youtube-ui.l.google.com172.217.16.206A (IP address)IN (0x0001)false
                                                        Oct 7, 2024 20:46:02.333398104 CEST1.1.1.1192.168.2.40xb226No error (0)youtube-ui.l.google.com142.250.186.110A (IP address)IN (0x0001)false
                                                        Oct 7, 2024 20:46:02.333398104 CEST1.1.1.1192.168.2.40xb226No error (0)youtube-ui.l.google.com142.250.186.46A (IP address)IN (0x0001)false
                                                        Oct 7, 2024 20:46:02.334083080 CEST1.1.1.1192.168.2.40x1377No error (0)www.youtube.comyoutube-ui.l.google.comCNAME (Canonical name)IN (0x0001)false
                                                        Oct 7, 2024 20:46:02.334083080 CEST1.1.1.1192.168.2.40x1377No error (0)youtube-ui.l.google.com65IN (0x0001)false
                                                        Oct 7, 2024 20:46:05.604778051 CEST1.1.1.1192.168.2.40x969cNo error (0)www.google.com142.250.185.132A (IP address)IN (0x0001)false
                                                        Oct 7, 2024 20:46:05.604821920 CEST1.1.1.1192.168.2.40xdba0No error (0)www.google.com65IN (0x0001)false
                                                        Oct 7, 2024 20:46:10.303683996 CEST1.1.1.1192.168.2.40x64bcNo error (0)accounts.youtube.comwww3.l.google.comCNAME (Canonical name)IN (0x0001)false
                                                        Oct 7, 2024 20:46:10.305794001 CEST1.1.1.1192.168.2.40xc76aNo error (0)accounts.youtube.comwww3.l.google.comCNAME (Canonical name)IN (0x0001)false
                                                        Oct 7, 2024 20:46:10.305794001 CEST1.1.1.1192.168.2.40xc76aNo error (0)www3.l.google.com142.250.185.174A (IP address)IN (0x0001)false
                                                        Oct 7, 2024 20:46:11.358124018 CEST1.1.1.1192.168.2.40xa670No error (0)play.google.com142.250.185.238A (IP address)IN (0x0001)false
                                                        Oct 7, 2024 20:47:14.173810005 CEST1.1.1.1192.168.2.40x5d0fNo error (0)play.google.com142.250.186.78A (IP address)IN (0x0001)false

                                                        HTTP Request Dependency Graph

                                                        • www.youtube.com
                                                        • https:
                                                          • accounts.youtube.com
                                                          • play.google.com
                                                          • www.google.com
                                                        • slscr.update.microsoft.com
                                                        • otelrules.azureedge.net

                                                        HTTPS Proxied Packets

                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        0192.168.2.449736142.250.185.1744437220C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:46:02 UTC902OUTGET /account?=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fchallenge%2Fpwd HTTP/1.1
                                                        Host: www.youtube.com
                                                        Connection: keep-alive
                                                        Upgrade-Insecure-Requests: 1
                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                                        X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=
                                                        Sec-Fetch-Site: none
                                                        Sec-Fetch-Mode: navigate
                                                        Sec-Fetch-User: ?1
                                                        Sec-Fetch-Dest: document
                                                        sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                                        sec-ch-ua-mobile: ?0
                                                        sec-ch-ua-platform: "Windows"
                                                        Accept-Encoding: gzip, deflate, br
                                                        Accept-Language: en-US,en;q=0.9
                                                        Cookie: YSC=S5HctmVlfJE
                                                        2024-10-07 18:46:03 UTC2530INHTTP/1.1 303 See Other
                                                        Content-Type: application/binary
                                                        X-Content-Type-Options: nosniff
                                                        Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                                                        Pragma: no-cache
                                                        Expires: Mon, 01 Jan 1990 00:00:00 GMT
                                                        Date: Mon, 07 Oct 2024 18:46:03 GMT
                                                        Location: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%253F%253Dhttps%25253A%25252F%25252Faccounts.google.com%25252Fv3%25252Fsignin%25252Fchallenge%25252Fpwd%26feature%3Dredirect_login&hl=en
                                                        X-Frame-Options: SAMEORIGIN
                                                        Strict-Transport-Security: max-age=31536000
                                                        Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
                                                        Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
                                                        Origin-Trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9
                                                        Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="youtube_main"
                                                        Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                                        Vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                                        Content-Security-Policy: require-trusted-types-for 'script'
                                                        P3P: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
                                                        Server: ESF
                                                        Content-Length: 0
                                                        X-XSS-Protection: 0
                                                        Set-Cookie: GPS=1; Domain=.youtube.com; Expires=Mon, 07-Oct-2024 19:16:03 GMT; Path=/; Secure; HttpOnly
                                                        Set-Cookie: VISITOR_INFO1_LIVE=DY3442Mulhw; Domain=.youtube.com; Expires=Sat, 05-Apr-2025 18:46:03 GMT; Path=/; Secure; HttpOnly; SameSite=none; Partitioned
                                                        Set-Cookie: VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgDg%3D%3D; Domain=.youtube.com; Expires=Sat, 05-Apr-2025 18:46:03 GMT; Path=/; Secure; HttpOnly; SameSite=none; Partitioned
                                                        Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                        Connection: close


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        1192.168.2.449756142.250.185.1744437220C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:46:10 UTC1224OUTGET /accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-560230264&timestamp=1728326769600 HTTP/1.1
                                                        Host: accounts.youtube.com
                                                        Connection: keep-alive
                                                        sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                                        sec-ch-ua-mobile: ?0
                                                        sec-ch-ua-full-version: "117.0.5938.132"
                                                        sec-ch-ua-arch: "x86"
                                                        sec-ch-ua-platform: "Windows"
                                                        sec-ch-ua-platform-version: "10.0.0"
                                                        sec-ch-ua-model: ""
                                                        sec-ch-ua-bitness: "64"
                                                        sec-ch-ua-wow64: ?0
                                                        sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"
                                                        Upgrade-Insecure-Requests: 1
                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                                        X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=
                                                        Sec-Fetch-Site: cross-site
                                                        Sec-Fetch-Mode: navigate
                                                        Sec-Fetch-Dest: iframe
                                                        Referer: https://accounts.google.com/
                                                        Accept-Encoding: gzip, deflate, br
                                                        Accept-Language: en-US,en;q=0.9
                                                        2024-10-07 18:46:11 UTC1967INHTTP/1.1 200 OK
                                                        Content-Type: text/html; charset=utf-8
                                                        X-Frame-Options: ALLOW-FROM https://accounts.google.com
                                                        Content-Security-Policy: frame-ancestors https://accounts.google.com
                                                        Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport
                                                        Content-Security-Policy: script-src 'report-sample' 'nonce-bMI4HRwxe6w_AMFHfRtZuQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport;worker-src 'self'
                                                        Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport/allowlist
                                                        Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                                                        Pragma: no-cache
                                                        Expires: Mon, 01 Jan 1990 00:00:00 GMT
                                                        Date: Mon, 07 Oct 2024 18:46:11 GMT
                                                        Cross-Origin-Resource-Policy: cross-origin
                                                        Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
                                                        Cross-Origin-Opener-Policy: same-origin
                                                        Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                                        reporting-endpoints: default="/_/AccountsDomainCookiesCheckConnectionHttp/web-reports?context=eJzjstDikmII1JBikPj6kkkDiJ3SZ7AGAXHSv_OsRUB8ufsS63UgVu25xGoKxEUSV1ibgFiIm-PzjQk72AR-XN5hrKSXlF8Yn5mSmleSWVKZkp-bmJmXnJ-fnZlaXJxaVJZaFG9kYGRiYGlkqWdgEV9gAADHAS2H"
                                                        Server: ESF
                                                        X-XSS-Protection: 0
                                                        X-Content-Type-Options: nosniff
                                                        Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                        Accept-Ranges: none
                                                        Vary: Accept-Encoding
                                                        Connection: close
                                                        Transfer-Encoding: chunked
                                                        2024-10-07 18:46:11 UTC1967INData Raw: 37 36 31 35 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 62 4d 49 34 48 52 77 78 65 36 77 5f 41 4d 46 48 66 52 74 5a 75 51 22 3e 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 41 63 63 6f 75 6e 74 73 44 6f 6d 61 69 6e 63 6f 6f 6b 69 65 73 43 68 65 63 6b 63 6f 6e 6e 65 63 74 69 6f 6e 4a 73 3d 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 41 63 63 6f 75 6e 74 73 44 6f 6d 61 69 6e 63 6f 6f 6b 69 65 73 43 68 65 63 6b 63 6f 6e 6e 65 63 74 69 6f 6e 4a 73 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 74 72 79 7b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f
                                                        Data Ascii: 7615<html><head><script nonce="bMI4HRwxe6w_AMFHfRtZuQ">"use strict";this.default_AccountsDomaincookiesCheckconnectionJs=this.default_AccountsDomaincookiesCheckconnectionJs||{};(function(_){var window=this;try{_._F_toggles_initialize=function(a){(typeo
                                                        2024-10-07 18:46:11 UTC1967INData Raw: 3d 2f 54 72 69 64 65 6e 74 5c 2f 28 5c 64 2e 5c 64 29 2f 2e 65 78 65 63 28 62 29 2c 0a 63 5b 31 5d 3d 3d 22 37 2e 30 22 29 69 66 28 62 26 26 62 5b 31 5d 29 73 77 69 74 63 68 28 62 5b 31 5d 29 7b 63 61 73 65 20 22 34 2e 30 22 3a 61 3d 22 38 2e 30 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 35 2e 30 22 3a 61 3d 22 39 2e 30 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 36 2e 30 22 3a 61 3d 22 31 30 2e 30 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 37 2e 30 22 3a 61 3d 22 31 31 2e 30 22 7d 65 6c 73 65 20 61 3d 22 37 2e 30 22 3b 65 6c 73 65 20 61 3d 63 5b 31 5d 3b 62 3d 61 7d 65 6c 73 65 20 62 3d 22 22 3b 72 65 74 75 72 6e 20 62 7d 76 61 72 20 64 3d 52 65 67 45 78 70 28 22 28 5b 41 2d 5a 5d 5b 5c 5c 77 20 5d 2b 29 2f 28 5b 5e 5c 5c 73 5d 2b 29 5c 5c 73 2a 28 3f 3a 5c
                                                        Data Ascii: =/Trident\/(\d.\d)/.exec(b),c[1]=="7.0")if(b&&b[1])switch(b[1]){case "4.0":a="8.0";break;case "5.0":a="9.0";break;case "6.0":a="10.0";break;case "7.0":a="11.0"}else a="7.0";else a=c[1];b=a}else b="";return b}var d=RegExp("([A-Z][\\w ]+)/([^\\s]+)\\s*(?:\
                                                        2024-10-07 18:46:11 UTC1967INData Raw: 7b 73 77 69 74 63 68 28 74 79 70 65 6f 66 20 61 29 7b 63 61 73 65 20 22 6e 75 6d 62 65 72 22 3a 72 65 74 75 72 6e 20 69 73 46 69 6e 69 74 65 28 61 29 3f 61 3a 53 74 72 69 6e 67 28 61 29 3b 63 61 73 65 20 22 62 69 67 69 6e 74 22 3a 72 65 74 75 72 6e 28 41 61 3f 0a 61 3e 3d 42 61 26 26 61 3c 3d 43 61 3a 61 5b 30 5d 3d 3d 3d 22 2d 22 3f 75 61 28 61 2c 44 61 29 3a 75 61 28 61 2c 45 61 29 29 3f 4e 75 6d 62 65 72 28 61 29 3a 53 74 72 69 6e 67 28 61 29 3b 63 61 73 65 20 22 62 6f 6f 6c 65 61 6e 22 3a 72 65 74 75 72 6e 20 61 3f 31 3a 30 3b 63 61 73 65 20 22 6f 62 6a 65 63 74 22 3a 69 66 28 61 29 69 66 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 61 29 29 7b 69 66 28 43 28 61 29 29 72 65 74 75 72 6e 7d 65 6c 73 65 20 69 66 28 46 61 26 26 61 21 3d 6e 75 6c 6c 26 26
                                                        Data Ascii: {switch(typeof a){case "number":return isFinite(a)?a:String(a);case "bigint":return(Aa?a>=Ba&&a<=Ca:a[0]==="-"?ua(a,Da):ua(a,Ea))?Number(a):String(a);case "boolean":return a?1:0;case "object":if(a)if(Array.isArray(a)){if(C(a))return}else if(Fa&&a!=null&&
                                                        2024-10-07 18:46:11 UTC1967INData Raw: 69 6f 6e 28 61 29 7b 76 61 72 20 62 3b 69 66 28 61 26 26 28 62 3d 51 61 29 21 3d 6e 75 6c 6c 26 26 62 2e 68 61 73 28 61 29 26 26 28 62 3d 61 2e 43 29 29 66 6f 72 28 76 61 72 20 63 3d 30 3b 63 3c 62 2e 6c 65 6e 67 74 68 3b 63 2b 2b 29 7b 76 61 72 20 64 3d 62 5b 63 5d 3b 69 66 28 63 3d 3d 3d 62 2e 6c 65 6e 67 74 68 2d 31 26 26 41 28 64 29 29 66 6f 72 28 76 61 72 20 65 20 69 6e 20 64 29 7b 76 61 72 20 66 3d 64 5b 65 5d 3b 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 66 29 26 26 0a 52 61 28 66 2c 61 29 7d 65 6c 73 65 20 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 64 29 26 26 52 61 28 64 2c 61 29 7d 61 3d 45 3f 61 2e 43 3a 4d 61 28 61 2e 43 2c 50 61 2c 76 6f 69 64 20 30 2c 76 6f 69 64 20 30 2c 21 31 29 3b 65 3d 21 45 3b 69 66 28 62 3d 61 2e 6c 65 6e 67 74 68 29 7b
                                                        Data Ascii: ion(a){var b;if(a&&(b=Qa)!=null&&b.has(a)&&(b=a.C))for(var c=0;c<b.length;c++){var d=b[c];if(c===b.length-1&&A(d))for(var e in d){var f=d[e];Array.isArray(f)&&Ra(f,a)}else Array.isArray(d)&&Ra(d,a)}a=E?a.C:Ma(a.C,Pa,void 0,void 0,!1);e=!E;if(b=a.length){
                                                        2024-10-07 18:46:11 UTC1967INData Raw: 0a 47 28 22 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 29 72 65 74 75 72 6e 20 61 3b 61 3d 53 79 6d 62 6f 6c 28 22 63 22 29 3b 66 6f 72 28 76 61 72 20 62 3d 22 41 72 72 61 79 20 49 6e 74 38 41 72 72 61 79 20 55 69 6e 74 38 41 72 72 61 79 20 55 69 6e 74 38 43 6c 61 6d 70 65 64 41 72 72 61 79 20 49 6e 74 31 36 41 72 72 61 79 20 55 69 6e 74 31 36 41 72 72 61 79 20 49 6e 74 33 32 41 72 72 61 79 20 55 69 6e 74 33 32 41 72 72 61 79 20 46 6c 6f 61 74 33 32 41 72 72 61 79 20 46 6c 6f 61 74 36 34 41 72 72 61 79 22 2e 73 70 6c 69 74 28 22 20 22 29 2c 63 3d 30 3b 63 3c 62 2e 6c 65 6e 67 74 68 3b 63 2b 2b 29 7b 76 61 72 20 64 3d 57 61 5b 62 5b 63 5d 5d 3b 74 79 70 65 6f 66 20 64 3d 3d 3d 22 66 75 6e 63 74 69 6f
                                                        Data Ascii: G("Symbol.iterator",function(a){if(a)return a;a=Symbol("c");for(var b="Array Int8Array Uint8Array Uint8ClampedArray Int16Array Uint16Array Int32Array Uint32Array Float32Array Float64Array".split(" "),c=0;c<b.length;c++){var d=Wa[b[c]];typeof d==="functio
                                                        2024-10-07 18:46:11 UTC1967INData Raw: 74 68 2e 72 61 6e 64 6f 6d 28 29 3b 65 28 22 66 72 65 65 7a 65 22 29 3b 65 28 22 70 72 65 76 65 6e 74 45 78 74 65 6e 73 69 6f 6e 73 22 29 3b 65 28 22 73 65 61 6c 22 29 3b 76 61 72 20 68 3d 30 2c 67 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 74 68 69 73 2e 67 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6b 29 7b 6b 3d 48 28 6b 29 3b 66 6f 72 28 76 61 72 20 6c 3b 21 28 6c 3d 6b 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6c 3d 6c 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6c 5b 30 5d 2c 6c 5b 31 5d 29 7d 7d 3b 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 69 66 28 21 63 28 6b 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 69 22 29 3b 64 28 6b 29 3b 69
                                                        Data Ascii: th.random();e("freeze");e("preventExtensions");e("seal");var h=0,g=function(k){this.g=(h+=Math.random()+1).toString();if(k){k=H(k);for(var l;!(l=k.next()).done;)l=l.value,this.set(l[0],l[1])}};g.prototype.set=function(k,l){if(!c(k))throw Error("i");d(k);i
                                                        2024-10-07 18:46:11 UTC1967INData Raw: 63 74 69 6f 6e 28 67 29 7b 72 65 74 75 72 6e 20 67 2e 76 61 6c 75 65 7d 29 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 66 6f 72 45 61 63 68 3d 66 75 6e 63 74 69 6f 6e 28 67 2c 6b 29 7b 66 6f 72 28 76 61 72 20 6c 3d 74 68 69 73 2e 65 6e 74 72 69 65 73 28 29 2c 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 0a 6d 2e 76 61 6c 75 65 2c 67 2e 63 61 6c 6c 28 6b 2c 6d 5b 31 5d 2c 6d 5b 30 5d 2c 74 68 69 73 29 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 63 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 3b 76 61 72 20 64 3d 66 75 6e 63 74 69 6f 6e 28 67 2c 6b 29 7b 76 61 72 20 6c 3d 6b 26 26 74 79 70 65 6f 66 20 6b 3b 6c 3d 3d 22 6f 62 6a 65 63 74 22 7c 7c 6c 3d 3d 22 66 75 6e 63 74 69
                                                        Data Ascii: ction(g){return g.value})};c.prototype.forEach=function(g,k){for(var l=this.entries(),m;!(m=l.next()).done;)m=m.value,g.call(k,m[1],m[0],this)};c.prototype[Symbol.iterator]=c.prototype.entries;var d=function(g,k){var l=k&&typeof k;l=="object"||l=="functi
                                                        2024-10-07 18:46:11 UTC1967INData Raw: 2e 69 73 4e 61 4e 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 62 3d 3d 3d 22 6e 75 6d 62 65 72 22 26 26 69 73 4e 61 4e 28 62 29 7d 7d 29 3b 76 61 72 20 66 62 3d 66 62 7c 7c 7b 7d 2c 71 3d 74 68 69 73 7c 7c 73 65 6c 66 2c 67 62 3d 71 2e 5f 46 5f 74 6f 67 67 6c 65 73 7c 7c 5b 5d 2c 68 62 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 61 2e 73 70 6c 69 74 28 22 2e 22 29 3b 66 6f 72 28 76 61 72 20 62 3d 71 2c 63 3d 30 3b 63 3c 61 2e 6c 65 6e 67 74 68 3b 63 2b 2b 29 69 66 28 62 3d 62 5b 61 5b 63 5d 5d 2c 62 3d 3d 6e 75 6c 6c 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 72 65 74 75 72 6e 20 62 7d 2c 69 62 3d 22 63 6c 6f 73 75 72 65 5f 75 69 64 5f 22 2b 28 4d 61
                                                        Data Ascii: .isNaN",function(a){return a?a:function(b){return typeof b==="number"&&isNaN(b)}});var fb=fb||{},q=this||self,gb=q._F_toggles||[],hb=function(a){a=a.split(".");for(var b=q,c=0;c<a.length;c++)if(b=b[a[c]],b==null)return null;return b},ib="closure_uid_"+(Ma
                                                        2024-10-07 18:46:11 UTC1967INData Raw: 73 75 72 65 5f 5f 65 72 72 6f 72 5f 5f 63 6f 6e 74 65 78 74 5f 5f 39 38 34 33 38 32 3d 7b 7d 29 3b 61 2e 5f 5f 63 6c 6f 73 75 72 65 5f 5f 65 72 72 6f 72 5f 5f 63 6f 6e 74 65 78 74 5f 5f 39 38 34 33 38 32 2e 73 65 76 65 72 69 74 79 3d 62 7d 3b 76 61 72 20 71 62 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 63 3d 63 7c 7c 71 3b 76 61 72 20 64 3d 63 2e 6f 6e 65 72 72 6f 72 2c 65 3d 21 21 62 3b 63 2e 6f 6e 65 72 72 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 66 2c 68 2c 67 2c 6b 2c 6c 29 7b 64 26 26 64 28 66 2c 68 2c 67 2c 6b 2c 6c 29 3b 61 28 7b 6d 65 73 73 61 67 65 3a 66 2c 66 69 6c 65 4e 61 6d 65 3a 68 2c 6c 69 6e 65 3a 67 2c 6c 69 6e 65 4e 75 6d 62 65 72 3a 67 2c 62 61 3a 6b 2c 65 72 72 6f 72 3a 6c 7d 29 3b 72 65 74 75 72 6e 20 65 7d 7d 2c 74 62 3d 66 75 6e
                                                        Data Ascii: sure__error__context__984382={});a.__closure__error__context__984382.severity=b};var qb=function(a,b,c){c=c||q;var d=c.onerror,e=!!b;c.onerror=function(f,h,g,k,l){d&&d(f,h,g,k,l);a({message:f,fileName:h,line:g,lineNumber:g,ba:k,error:l});return e}},tb=fun
                                                        2024-10-07 18:46:11 UTC1967INData Raw: 74 72 69 6e 67 22 3a 62 72 65 61 6b 3b 63 61 73 65 20 22 6e 75 6d 62 65 72 22 3a 66 3d 53 74 72 69 6e 67 28 66 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 62 6f 6f 6c 65 61 6e 22 3a 66 3d 66 3f 22 74 72 75 65 22 3a 22 66 61 6c 73 65 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 66 75 6e 63 74 69 6f 6e 22 3a 66 3d 28 66 3d 73 62 28 66 29 29 3f 66 3a 22 5b 66 6e 5d 22 3b 62 72 65 61 6b 3b 64 65 66 61 75 6c 74 3a 66 3d 0a 74 79 70 65 6f 66 20 66 7d 66 2e 6c 65 6e 67 74 68 3e 34 30 26 26 28 66 3d 66 2e 73 6c 69 63 65 28 30 2c 34 30 29 2b 22 2e 2e 2e 22 29 3b 63 2e 70 75 73 68 28 66 29 7d 62 2e 70 75 73 68 28 61 29 3b 63 2e 70 75 73 68 28 22 29 5c 6e 22 29 3b 74 72 79 7b 63 2e 70 75 73 68 28 77 62 28 61 2e 63 61 6c 6c 65 72 2c 62 29 29 7d 63 61 74 63 68 28 68 29 7b
                                                        Data Ascii: tring":break;case "number":f=String(f);break;case "boolean":f=f?"true":"false";break;case "function":f=(f=sb(f))?f:"[fn]";break;default:f=typeof f}f.length>40&&(f=f.slice(0,40)+"...");c.push(f)}b.push(a);c.push(")\n");try{c.push(wb(a.caller,b))}catch(h){


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        2192.168.2.449760142.250.185.2384437220C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:46:11 UTC549OUTOPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1
                                                        Host: play.google.com
                                                        Connection: keep-alive
                                                        Accept: */*
                                                        Access-Control-Request-Method: POST
                                                        Access-Control-Request-Headers: x-goog-authuser
                                                        Origin: https://accounts.google.com
                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                        Sec-Fetch-Mode: cors
                                                        Sec-Fetch-Site: same-site
                                                        Sec-Fetch-Dest: empty
                                                        Referer: https://accounts.google.com/
                                                        Accept-Encoding: gzip, deflate, br
                                                        Accept-Language: en-US,en;q=0.9
                                                        2024-10-07 18:46:12 UTC520INHTTP/1.1 200 OK
                                                        Access-Control-Allow-Origin: https://accounts.google.com
                                                        Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                        Access-Control-Max-Age: 86400
                                                        Access-Control-Allow-Credentials: true
                                                        Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser
                                                        Content-Type: text/plain; charset=UTF-8
                                                        Date: Mon, 07 Oct 2024 18:46:12 GMT
                                                        Server: Playlog
                                                        Content-Length: 0
                                                        X-XSS-Protection: 0
                                                        X-Frame-Options: SAMEORIGIN
                                                        Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                        Connection: close


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        3192.168.2.449762142.250.185.2384437220C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:46:12 UTC549OUTOPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1
                                                        Host: play.google.com
                                                        Connection: keep-alive
                                                        Accept: */*
                                                        Access-Control-Request-Method: POST
                                                        Access-Control-Request-Headers: x-goog-authuser
                                                        Origin: https://accounts.google.com
                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                        Sec-Fetch-Mode: cors
                                                        Sec-Fetch-Site: same-site
                                                        Sec-Fetch-Dest: empty
                                                        Referer: https://accounts.google.com/
                                                        Accept-Encoding: gzip, deflate, br
                                                        Accept-Language: en-US,en;q=0.9
                                                        2024-10-07 18:46:12 UTC520INHTTP/1.1 200 OK
                                                        Access-Control-Allow-Origin: https://accounts.google.com
                                                        Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                        Access-Control-Max-Age: 86400
                                                        Access-Control-Allow-Credentials: true
                                                        Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser
                                                        Content-Type: text/plain; charset=UTF-8
                                                        Date: Mon, 07 Oct 2024 18:46:12 GMT
                                                        Server: Playlog
                                                        Content-Length: 0
                                                        X-XSS-Protection: 0
                                                        X-Frame-Options: SAMEORIGIN
                                                        Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                        Connection: close


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        4192.168.2.449765142.250.185.2384437220C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:46:12 UTC1132OUTPOST /log?format=json&hasfast=true&authuser=0 HTTP/1.1
                                                        Host: play.google.com
                                                        Connection: keep-alive
                                                        Content-Length: 518
                                                        sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                                        sec-ch-ua-mobile: ?0
                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                        sec-ch-ua-arch: "x86"
                                                        Content-Type: application/x-www-form-urlencoded;charset=UTF-8
                                                        sec-ch-ua-full-version: "117.0.5938.132"
                                                        sec-ch-ua-platform-version: "10.0.0"
                                                        X-Goog-AuthUser: 0
                                                        sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"
                                                        sec-ch-ua-bitness: "64"
                                                        sec-ch-ua-model: ""
                                                        sec-ch-ua-wow64: ?0
                                                        sec-ch-ua-platform: "Windows"
                                                        Accept: */*
                                                        Origin: https://accounts.google.com
                                                        X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=
                                                        Sec-Fetch-Site: same-site
                                                        Sec-Fetch-Mode: cors
                                                        Sec-Fetch-Dest: empty
                                                        Referer: https://accounts.google.com/
                                                        Accept-Encoding: gzip, deflate, br
                                                        Accept-Language: en-US,en;q=0.9
                                                        2024-10-07 18:46:12 UTC518OUTData Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 33 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 38 33 32 36 37 37 30 36 35 33 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c
                                                        Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"31",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],1828,[["1728326770653",null,null,null
                                                        2024-10-07 18:46:13 UTC933INHTTP/1.1 200 OK
                                                        Access-Control-Allow-Origin: https://accounts.google.com
                                                        Cross-Origin-Resource-Policy: cross-origin
                                                        Access-Control-Allow-Credentials: true
                                                        Access-Control-Allow-Headers: X-Playlog-Web
                                                        Set-Cookie: NID=518=l6RhwBIEnQ0sdkLit3GV36k4WWPtKRXXI_zxtvmrJYfUl7HHRnOlDlNPSVQiUi3A5RIxxrsUl1voIWoa4Nd13AoC7YmntBUvy6vLYfAGPTzaq5_bWC1B4TSysCwDglrBVjSmkxBolXQq2q0i1aBcQEcuWWGSL4zdimp5AoCaJ8avbJkrpJU; expires=Tue, 08-Apr-2025 18:46:12 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none
                                                        P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."
                                                        Content-Type: text/plain; charset=UTF-8
                                                        Date: Mon, 07 Oct 2024 18:46:12 GMT
                                                        Server: Playlog
                                                        Cache-Control: private
                                                        X-XSS-Protection: 0
                                                        X-Frame-Options: SAMEORIGIN
                                                        Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                        Accept-Ranges: none
                                                        Vary: Accept-Encoding
                                                        Expires: Mon, 07 Oct 2024 18:46:12 GMT
                                                        Connection: close
                                                        Transfer-Encoding: chunked
                                                        2024-10-07 18:46:13 UTC137INData Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a
                                                        Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
                                                        2024-10-07 18:46:13 UTC5INData Raw: 30 0d 0a 0d 0a
                                                        Data Ascii: 0


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        5192.168.2.449766142.250.185.2384437220C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:46:12 UTC1132OUTPOST /log?format=json&hasfast=true&authuser=0 HTTP/1.1
                                                        Host: play.google.com
                                                        Connection: keep-alive
                                                        Content-Length: 519
                                                        sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                                        sec-ch-ua-mobile: ?0
                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                        sec-ch-ua-arch: "x86"
                                                        Content-Type: application/x-www-form-urlencoded;charset=UTF-8
                                                        sec-ch-ua-full-version: "117.0.5938.132"
                                                        sec-ch-ua-platform-version: "10.0.0"
                                                        X-Goog-AuthUser: 0
                                                        sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"
                                                        sec-ch-ua-bitness: "64"
                                                        sec-ch-ua-model: ""
                                                        sec-ch-ua-wow64: ?0
                                                        sec-ch-ua-platform: "Windows"
                                                        Accept: */*
                                                        Origin: https://accounts.google.com
                                                        X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=
                                                        Sec-Fetch-Site: same-site
                                                        Sec-Fetch-Mode: cors
                                                        Sec-Fetch-Dest: empty
                                                        Referer: https://accounts.google.com/
                                                        Accept-Encoding: gzip, deflate, br
                                                        Accept-Language: en-US,en;q=0.9
                                                        2024-10-07 18:46:12 UTC519OUTData Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 33 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 38 33 32 36 37 37 30 37 33 35 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c
                                                        Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"31",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],1828,[["1728326770735",null,null,null
                                                        2024-10-07 18:46:13 UTC933INHTTP/1.1 200 OK
                                                        Access-Control-Allow-Origin: https://accounts.google.com
                                                        Cross-Origin-Resource-Policy: cross-origin
                                                        Access-Control-Allow-Credentials: true
                                                        Access-Control-Allow-Headers: X-Playlog-Web
                                                        Set-Cookie: NID=518=PNEHn0j6dWydLmDzUU064NX0LLpAsu24RYTiBxCpZFJw_nBLnlLoNb4uRqc0mo73zrmFeflDSpZua9G3l4BoBOnAQ6qtlc9lwUBa8bEFkLlJAf4UH_hlRgr8bWo_TpWUKwyj0bl8eITPxhfUvICXEjBdsoH_HQRw0rOb6AEoRz829aBCTuw; expires=Tue, 08-Apr-2025 18:46:13 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none
                                                        P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."
                                                        Content-Type: text/plain; charset=UTF-8
                                                        Date: Mon, 07 Oct 2024 18:46:13 GMT
                                                        Server: Playlog
                                                        Cache-Control: private
                                                        X-XSS-Protection: 0
                                                        X-Frame-Options: SAMEORIGIN
                                                        Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                        Accept-Ranges: none
                                                        Vary: Accept-Encoding
                                                        Expires: Mon, 07 Oct 2024 18:46:13 GMT
                                                        Connection: close
                                                        Transfer-Encoding: chunked
                                                        2024-10-07 18:46:13 UTC137INData Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a
                                                        Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
                                                        2024-10-07 18:46:13 UTC5INData Raw: 30 0d 0a 0d 0a
                                                        Data Ascii: 0


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        6192.168.2.449741142.250.185.1324437220C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:46:13 UTC1222OUTGET /favicon.ico HTTP/1.1
                                                        Host: www.google.com
                                                        Connection: keep-alive
                                                        sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                                        sec-ch-ua-mobile: ?0
                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                        sec-ch-ua-arch: "x86"
                                                        sec-ch-ua-full-version: "117.0.5938.132"
                                                        sec-ch-ua-platform-version: "10.0.0"
                                                        sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"
                                                        sec-ch-ua-bitness: "64"
                                                        sec-ch-ua-model: ""
                                                        sec-ch-ua-wow64: ?0
                                                        sec-ch-ua-platform: "Windows"
                                                        Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                                                        X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=
                                                        Sec-Fetch-Site: same-site
                                                        Sec-Fetch-Mode: no-cors
                                                        Sec-Fetch-Dest: image
                                                        Referer: https://accounts.google.com/
                                                        Accept-Encoding: gzip, deflate, br
                                                        Accept-Language: en-US,en;q=0.9
                                                        Cookie: NID=518=l6RhwBIEnQ0sdkLit3GV36k4WWPtKRXXI_zxtvmrJYfUl7HHRnOlDlNPSVQiUi3A5RIxxrsUl1voIWoa4Nd13AoC7YmntBUvy6vLYfAGPTzaq5_bWC1B4TSysCwDglrBVjSmkxBolXQq2q0i1aBcQEcuWWGSL4zdimp5AoCaJ8avbJkrpJU
                                                        2024-10-07 18:46:13 UTC705INHTTP/1.1 200 OK
                                                        Accept-Ranges: bytes
                                                        Cross-Origin-Resource-Policy: cross-origin
                                                        Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable"
                                                        Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
                                                        Content-Length: 5430
                                                        X-Content-Type-Options: nosniff
                                                        Server: sffe
                                                        X-XSS-Protection: 0
                                                        Date: Mon, 07 Oct 2024 17:53:36 GMT
                                                        Expires: Tue, 15 Oct 2024 17:53:36 GMT
                                                        Cache-Control: public, max-age=691200
                                                        Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT
                                                        Content-Type: image/x-icon
                                                        Vary: Accept-Encoding
                                                        Age: 3157
                                                        Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                        Connection: close
                                                        2024-10-07 18:46:13 UTC685INData Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff
                                                        Data Ascii: h& ( 0.v]X:X:rY
                                                        2024-10-07 18:46:13 UTC1390INData Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b 49 eb ff 95 9c f4 ff cf d2 fa ff d1 d4 fa ff 96 9d f4 ff 52 5e ed ff e1 e3 fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 30 00 00 00 00 fd fd fd 9d ff ff ff ff e8 ea fd ff 58 63 ee ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 6c 76 f0 ff ff ff ff ff ff ff ff ff fd fd fd 98 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd c3 ff ff ff ff f9 f9 fe ff a5 ac f6 ff 5d 69 ee ff 3c 4a
                                                        Data Ascii: 7R8F2Vb5C;IR^0Xc5C5C5C5C5C5Clv]i<J
                                                        2024-10-07 18:46:13 UTC1390INData Raw: ff ff ff ff ff ff ff ff ff ff ff fd fd fd d0 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd fd fd 8b ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b1 d8 a3 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 60 a5 35 ff ca 8e 3e ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 87 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 25 fd fd fd fb ff ff ff ff ff ff ff ff ff ff ff ff c2 e0 b7 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 6e b6 54 ff 9f ce 8d ff b7 da aa ff b8 db ab ff a5 d2 95 ff 7b bc 64 ff 54 a8 35 ff 53 a8 34 ff 77 a0 37 ff e3 89 41 ff f4 85 42 ff f4 85 42 ff
                                                        Data Ascii: S4S4S4S4S4S4S4S4S4S4S4S4S4S4`5>%S4S4S4S4S4S4nT{dT5S4w7ABB
                                                        2024-10-07 18:46:13 UTC1390INData Raw: ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fb d5 bf ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd cb ff ff ff ff ff ff ff ff ff ff ff ff 46 cd fc ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 21 ae f9 ff fb fb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd c8 fd fd fd 9c ff ff ff ff ff ff ff ff ff ff ff ff 86 df fd ff 05 bc fb ff 05 bc fb ff 15 93 f5 ff 34 49 eb ff b3 b8 f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                                        Data Ascii: BBBBBBF!4I
                                                        2024-10-07 18:46:13 UTC575INData Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd 8d fd fd fd fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd fb fd fd fd 8b fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 27 fd fd fd 9f fd fd fd f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                                        Data Ascii: $'


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        7192.168.2.4497694.175.87.197443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:46:15 UTC306OUTGET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=hRm6SBNxBBMyyht&MD=xmKsWxeB HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept: */*
                                                        User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33
                                                        Host: slscr.update.microsoft.com
                                                        2024-10-07 18:46:16 UTC560INHTTP/1.1 200 OK
                                                        Cache-Control: no-cache
                                                        Pragma: no-cache
                                                        Content-Type: application/octet-stream
                                                        Expires: -1
                                                        Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT
                                                        ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880"
                                                        MS-CorrelationId: 236ff8f2-8a15-4002-ae3f-c58b9c5621ca
                                                        MS-RequestId: 23e4091b-3600-4d12-a789-626c9f492e21
                                                        MS-CV: VKyS9RRkOkmay6Gq.0
                                                        X-Microsoft-SLSClientCache: 2880
                                                        Content-Disposition: attachment; filename=environment.cab
                                                        X-Content-Type-Options: nosniff
                                                        Date: Mon, 07 Oct 2024 18:46:15 GMT
                                                        Connection: close
                                                        Content-Length: 24490
                                                        2024-10-07 18:46:16 UTC15824INData Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58
                                                        Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
                                                        2024-10-07 18:46:16 UTC8666INData Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31
                                                        Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        8192.168.2.449780142.250.185.2384437220C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:46:20 UTC1307OUTPOST /log?format=json&hasfast=true&authuser=0 HTTP/1.1
                                                        Host: play.google.com
                                                        Connection: keep-alive
                                                        Content-Length: 1221
                                                        sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                                        sec-ch-ua-mobile: ?0
                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                        sec-ch-ua-arch: "x86"
                                                        Content-Type: text/plain;charset=UTF-8
                                                        sec-ch-ua-full-version: "117.0.5938.132"
                                                        sec-ch-ua-platform-version: "10.0.0"
                                                        X-Goog-AuthUser: 0
                                                        sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"
                                                        sec-ch-ua-bitness: "64"
                                                        sec-ch-ua-model: ""
                                                        sec-ch-ua-wow64: ?0
                                                        sec-ch-ua-platform: "Windows"
                                                        Accept: */*
                                                        Origin: https://accounts.google.com
                                                        X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=
                                                        Sec-Fetch-Site: same-site
                                                        Sec-Fetch-Mode: cors
                                                        Sec-Fetch-Dest: empty
                                                        Referer: https://accounts.google.com/
                                                        Accept-Encoding: gzip, deflate, br
                                                        Accept-Language: en-US,en;q=0.9
                                                        Cookie: NID=518=PNEHn0j6dWydLmDzUU064NX0LLpAsu24RYTiBxCpZFJw_nBLnlLoNb4uRqc0mo73zrmFeflDSpZua9G3l4BoBOnAQ6qtlc9lwUBa8bEFkLlJAf4UH_hlRgr8bWo_TpWUKwyj0bl8eITPxhfUvICXEjBdsoH_HQRw0rOb6AEoRz829aBCTuw
                                                        2024-10-07 18:46:20 UTC1221OUTData Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 34 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 35 35 38 2c 5b 5b 22 31 37 32 38 33 32 36 37 36 38 30 30 30 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c
                                                        Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[4,0,0,0,0]]],558,[["1728326768000",null,null,null,
                                                        2024-10-07 18:46:20 UTC941INHTTP/1.1 200 OK
                                                        Access-Control-Allow-Origin: https://accounts.google.com
                                                        Cross-Origin-Resource-Policy: cross-origin
                                                        Access-Control-Allow-Credentials: true
                                                        Access-Control-Allow-Headers: X-Playlog-Web
                                                        Set-Cookie: NID=518=cBIDocdZDNKtPWSh2XYxgbf-oOo05p2etVhWD-mvq5xn653c3R21cEDtaW3wGSphNxDDT5tLi29Ps0aTAV2vWFuHZcBL0O_-okpi4Z4ixgo0dmmSMLM1oJocNgOv21xb3Jkg23M44sfxag3tG6TmJpDnzevg34QD9GsWFWIUoLBpuFi2UXEexsaZ7P4; expires=Tue, 08-Apr-2025 18:46:20 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none
                                                        P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."
                                                        Content-Type: text/plain; charset=UTF-8
                                                        Date: Mon, 07 Oct 2024 18:46:20 GMT
                                                        Server: Playlog
                                                        Cache-Control: private
                                                        X-XSS-Protection: 0
                                                        X-Frame-Options: SAMEORIGIN
                                                        Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                        Accept-Ranges: none
                                                        Vary: Accept-Encoding
                                                        Expires: Mon, 07 Oct 2024 18:46:20 GMT
                                                        Connection: close
                                                        Transfer-Encoding: chunked
                                                        2024-10-07 18:46:20 UTC137INData Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a
                                                        Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
                                                        2024-10-07 18:46:20 UTC5INData Raw: 30 0d 0a 0d 0a
                                                        Data Ascii: 0


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        9192.168.2.460164142.250.185.2384437220C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:46:42 UTC1298OUTPOST /log?hasfast=true&authuser=0&format=json HTTP/1.1
                                                        Host: play.google.com
                                                        Connection: keep-alive
                                                        Content-Length: 1066
                                                        sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                                        sec-ch-ua-mobile: ?0
                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                        sec-ch-ua-arch: "x86"
                                                        sec-ch-ua-full-version: "117.0.5938.132"
                                                        Content-Type: text/plain;charset=UTF-8
                                                        sec-ch-ua-platform-version: "10.0.0"
                                                        sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"
                                                        sec-ch-ua-bitness: "64"
                                                        sec-ch-ua-model: ""
                                                        sec-ch-ua-wow64: ?0
                                                        sec-ch-ua-platform: "Windows"
                                                        Accept: */*
                                                        Origin: https://accounts.google.com
                                                        X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=
                                                        Sec-Fetch-Site: same-site
                                                        Sec-Fetch-Mode: no-cors
                                                        Sec-Fetch-Dest: empty
                                                        Referer: https://accounts.google.com/
                                                        Accept-Encoding: gzip, deflate, br
                                                        Accept-Language: en-US,en;q=0.9
                                                        Cookie: NID=518=cBIDocdZDNKtPWSh2XYxgbf-oOo05p2etVhWD-mvq5xn653c3R21cEDtaW3wGSphNxDDT5tLi29Ps0aTAV2vWFuHZcBL0O_-okpi4Z4ixgo0dmmSMLM1oJocNgOv21xb3Jkg23M44sfxag3tG6TmJpDnzevg34QD9GsWFWIUoLBpuFi2UXEexsaZ7P4
                                                        2024-10-07 18:46:42 UTC1066OUTData Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 62 6f 71 5f 69 64 65 6e 74 69 74 79 66 72 6f 6e 74 65 6e 64 61 75 74 68 75 69 73 65 72 76 65 72 5f 32 30 32 34 31 30 30 31 2e 30 36 5f 70 30 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 33 2c 30 2c 30
                                                        Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"boq_identityfrontendauthuiserver_20241001.06_p0",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[3,0,0
                                                        2024-10-07 18:46:43 UTC523INHTTP/1.1 200 OK
                                                        Access-Control-Allow-Origin: https://accounts.google.com
                                                        Cross-Origin-Resource-Policy: cross-origin
                                                        Access-Control-Allow-Credentials: true
                                                        Access-Control-Allow-Headers: X-Playlog-Web
                                                        Content-Type: text/plain; charset=UTF-8
                                                        Date: Mon, 07 Oct 2024 18:46:43 GMT
                                                        Server: Playlog
                                                        Cache-Control: private
                                                        X-XSS-Protection: 0
                                                        X-Frame-Options: SAMEORIGIN
                                                        Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                        Accept-Ranges: none
                                                        Vary: Accept-Encoding
                                                        Connection: close
                                                        Transfer-Encoding: chunked
                                                        2024-10-07 18:46:43 UTC137INData Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a
                                                        Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
                                                        2024-10-07 18:46:43 UTC5INData Raw: 30 0d 0a 0d 0a
                                                        Data Ascii: 0


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        10192.168.2.460166142.250.185.2384437220C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:46:44 UTC1338OUTPOST /log?format=json&hasfast=true&authuser=0 HTTP/1.1
                                                        Host: play.google.com
                                                        Connection: keep-alive
                                                        Content-Length: 1324
                                                        sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                                        sec-ch-ua-mobile: ?0
                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                        sec-ch-ua-arch: "x86"
                                                        Content-Type: application/x-www-form-urlencoded;charset=UTF-8
                                                        sec-ch-ua-full-version: "117.0.5938.132"
                                                        sec-ch-ua-platform-version: "10.0.0"
                                                        X-Goog-AuthUser: 0
                                                        sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"
                                                        sec-ch-ua-bitness: "64"
                                                        sec-ch-ua-model: ""
                                                        sec-ch-ua-wow64: ?0
                                                        sec-ch-ua-platform: "Windows"
                                                        Accept: */*
                                                        Origin: https://accounts.google.com
                                                        X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=
                                                        Sec-Fetch-Site: same-site
                                                        Sec-Fetch-Mode: cors
                                                        Sec-Fetch-Dest: empty
                                                        Referer: https://accounts.google.com/
                                                        Accept-Encoding: gzip, deflate, br
                                                        Accept-Language: en-US,en;q=0.9
                                                        Cookie: NID=518=cBIDocdZDNKtPWSh2XYxgbf-oOo05p2etVhWD-mvq5xn653c3R21cEDtaW3wGSphNxDDT5tLi29Ps0aTAV2vWFuHZcBL0O_-okpi4Z4ixgo0dmmSMLM1oJocNgOv21xb3Jkg23M44sfxag3tG6TmJpDnzevg34QD9GsWFWIUoLBpuFi2UXEexsaZ7P4
                                                        2024-10-07 18:46:44 UTC1324OUTData Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 33 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 38 33 32 36 38 30 33 30 32 31 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c
                                                        Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"31",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],1828,[["1728326803021",null,null,null
                                                        2024-10-07 18:46:44 UTC523INHTTP/1.1 200 OK
                                                        Access-Control-Allow-Origin: https://accounts.google.com
                                                        Cross-Origin-Resource-Policy: cross-origin
                                                        Access-Control-Allow-Credentials: true
                                                        Access-Control-Allow-Headers: X-Playlog-Web
                                                        Content-Type: text/plain; charset=UTF-8
                                                        Date: Mon, 07 Oct 2024 18:46:44 GMT
                                                        Server: Playlog
                                                        Cache-Control: private
                                                        X-XSS-Protection: 0
                                                        X-Frame-Options: SAMEORIGIN
                                                        Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                        Accept-Ranges: none
                                                        Vary: Accept-Encoding
                                                        Connection: close
                                                        Transfer-Encoding: chunked
                                                        2024-10-07 18:46:44 UTC137INData Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a
                                                        Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
                                                        2024-10-07 18:46:44 UTC5INData Raw: 30 0d 0a 0d 0a
                                                        Data Ascii: 0


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        11192.168.2.460165142.250.185.2384437220C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:46:44 UTC1338OUTPOST /log?format=json&hasfast=true&authuser=0 HTTP/1.1
                                                        Host: play.google.com
                                                        Connection: keep-alive
                                                        Content-Length: 1235
                                                        sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                                        sec-ch-ua-mobile: ?0
                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                        sec-ch-ua-arch: "x86"
                                                        Content-Type: application/x-www-form-urlencoded;charset=UTF-8
                                                        sec-ch-ua-full-version: "117.0.5938.132"
                                                        sec-ch-ua-platform-version: "10.0.0"
                                                        X-Goog-AuthUser: 0
                                                        sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"
                                                        sec-ch-ua-bitness: "64"
                                                        sec-ch-ua-model: ""
                                                        sec-ch-ua-wow64: ?0
                                                        sec-ch-ua-platform: "Windows"
                                                        Accept: */*
                                                        Origin: https://accounts.google.com
                                                        X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=
                                                        Sec-Fetch-Site: same-site
                                                        Sec-Fetch-Mode: cors
                                                        Sec-Fetch-Dest: empty
                                                        Referer: https://accounts.google.com/
                                                        Accept-Encoding: gzip, deflate, br
                                                        Accept-Language: en-US,en;q=0.9
                                                        Cookie: NID=518=cBIDocdZDNKtPWSh2XYxgbf-oOo05p2etVhWD-mvq5xn653c3R21cEDtaW3wGSphNxDDT5tLi29Ps0aTAV2vWFuHZcBL0O_-okpi4Z4ixgo0dmmSMLM1oJocNgOv21xb3Jkg23M44sfxag3tG6TmJpDnzevg34QD9GsWFWIUoLBpuFi2UXEexsaZ7P4
                                                        2024-10-07 18:46:44 UTC1235OUTData Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 33 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 38 33 32 36 38 30 33 32 34 30 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c
                                                        Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"31",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],1828,[["1728326803240",null,null,null
                                                        2024-10-07 18:46:44 UTC523INHTTP/1.1 200 OK
                                                        Access-Control-Allow-Origin: https://accounts.google.com
                                                        Cross-Origin-Resource-Policy: cross-origin
                                                        Access-Control-Allow-Credentials: true
                                                        Access-Control-Allow-Headers: X-Playlog-Web
                                                        Content-Type: text/plain; charset=UTF-8
                                                        Date: Mon, 07 Oct 2024 18:46:44 GMT
                                                        Server: Playlog
                                                        Cache-Control: private
                                                        X-XSS-Protection: 0
                                                        X-Frame-Options: SAMEORIGIN
                                                        Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                        Accept-Ranges: none
                                                        Vary: Accept-Encoding
                                                        Connection: close
                                                        Transfer-Encoding: chunked
                                                        2024-10-07 18:46:44 UTC137INData Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a
                                                        Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
                                                        2024-10-07 18:46:44 UTC5INData Raw: 30 0d 0a 0d 0a
                                                        Data Ascii: 0


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        12192.168.2.4601674.175.87.197443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:46:53 UTC306OUTGET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=hRm6SBNxBBMyyht&MD=xmKsWxeB HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept: */*
                                                        User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33
                                                        Host: slscr.update.microsoft.com
                                                        2024-10-07 18:46:54 UTC560INHTTP/1.1 200 OK
                                                        Cache-Control: no-cache
                                                        Pragma: no-cache
                                                        Content-Type: application/octet-stream
                                                        Expires: -1
                                                        Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT
                                                        ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440"
                                                        MS-CorrelationId: d1fa4887-3803-442b-b2d0-c32bba31b849
                                                        MS-RequestId: d2c83022-7eff-4b1c-a43c-bf6c523b376e
                                                        MS-CV: Rzv3R8H1/UKpvL2F.0
                                                        X-Microsoft-SLSClientCache: 1440
                                                        Content-Disposition: attachment; filename=environment.cab
                                                        X-Content-Type-Options: nosniff
                                                        Date: Mon, 07 Oct 2024 18:46:53 GMT
                                                        Connection: close
                                                        Content-Length: 30005
                                                        2024-10-07 18:46:54 UTC15824INData Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e
                                                        Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
                                                        2024-10-07 18:46:54 UTC14181INData Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f
                                                        Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        13192.168.2.46016813.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:46:55 UTC195OUTGET /rules/other-Win32-v19.bundle HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:46:55 UTC540INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:46:55 GMT
                                                        Content-Type: text/plain
                                                        Content-Length: 218853
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public
                                                        Last-Modified: Sun, 06 Oct 2024 16:59:23 GMT
                                                        ETag: "0x8DCE6283A3FA58B"
                                                        x-ms-request-id: 86eceaf5-401e-00a3-6fa2-188b09000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184655Z-1657d5bbd48t66tjar5xuq22r800000003v000000000fyrr
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:46:55 UTC15844INData Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20
                                                        Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
                                                        2024-10-07 18:46:55 UTC16384INData Raw: 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e
                                                        Data Ascii: "0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" />
                                                        2024-10-07 18:46:55 UTC16384INData Raw: 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31
                                                        Data Ascii: <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-781
                                                        2024-10-07 18:46:56 UTC16384INData Raw: 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20
                                                        Data Ascii: T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32"
                                                        2024-10-07 18:46:56 UTC16384INData Raw: 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f
                                                        Data Ascii: "0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Co
                                                        2024-10-07 18:46:56 UTC16384INData Raw: 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a
                                                        Data Ascii: <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C>
                                                        2024-10-07 18:46:56 UTC16384INData Raw: 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63
                                                        Data Ascii: <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMillisec
                                                        2024-10-07 18:46:56 UTC16384INData Raw: 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e
                                                        Data Ascii: R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIn
                                                        2024-10-07 18:46:56 UTC16384INData Raw: 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20
                                                        Data Ascii: R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L>
                                                        2024-10-07 18:46:56 UTC16384INData Raw: 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c
                                                        Data Ascii: T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        14192.168.2.46017313.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:46:56 UTC192OUTGET /rules/rule120609v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:46:56 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:46:56 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 408
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT
                                                        ETag: "0x8DC582BB56D3AFB"
                                                        x-ms-request-id: 28f6fc08-301e-0020-466a-176299000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184656Z-1657d5bbd482krtfgrg72dfbtn00000003gg00000000x1n9
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:46:56 UTC408INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        15192.168.2.46017113.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:46:56 UTC192OUTGET /rules/rule120600v4s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:46:56 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:46:56 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 2980
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT
                                                        ETag: "0x8DC582BA80D96A1"
                                                        x-ms-request-id: 8aaf7b13-d01e-0028-46fd-167896000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184656Z-1657d5bbd48dfrdj7px744zp8s00000003h000000000wc95
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:46:56 UTC2980INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        16192.168.2.46016913.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:46:56 UTC193OUTGET /rules/rule120402v21s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:46:56 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:46:56 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 3788
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT
                                                        ETag: "0x8DC582BAC2126A6"
                                                        x-ms-request-id: 4545068c-701e-0050-0e05-176767000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184656Z-1657d5bbd487nf59mzf5b3gk8n00000003d000000000vcsb
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:46:56 UTC3788INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        17192.168.2.46017013.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:46:56 UTC192OUTGET /rules/rule224902v2s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:46:56 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:46:56 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 450
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT
                                                        ETag: "0x8DC582BD4C869AE"
                                                        x-ms-request-id: d4448e94-101e-00a2-2703-179f2e000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184656Z-1657d5bbd48qjg85buwfdynm5w0000000410000000006669
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:46:56 UTC450INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        18192.168.2.46017213.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:46:56 UTC192OUTGET /rules/rule120608v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:46:56 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:46:56 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 2160
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT
                                                        ETag: "0x8DC582BA3B95D81"
                                                        x-ms-request-id: c59bb0f9-701e-0097-2d01-17b8c1000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184656Z-1657d5bbd4824mj9d6vp65b6n400000003zg00000000xguk
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:46:56 UTC2160INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        19192.168.2.46017813.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:46:57 UTC192OUTGET /rules/rule120614v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:46:57 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:46:57 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 467
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT
                                                        ETag: "0x8DC582BA6C038BC"
                                                        x-ms-request-id: 87fc294c-201e-0051-40f3-167340000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184657Z-1657d5bbd48brl8we3nu8cxwgn000000049g00000000015a
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:46:57 UTC467INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        20192.168.2.46017513.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:46:57 UTC192OUTGET /rules/rule120611v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:46:57 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:46:57 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 415
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT
                                                        ETag: "0x8DC582B9F6F3512"
                                                        x-ms-request-id: 1707b783-801e-00a3-53e5-167cfb000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184657Z-1657d5bbd48xsz2nuzq4vfrzg800000003mg000000012xbk
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:46:57 UTC415INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        21192.168.2.46017613.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:46:57 UTC192OUTGET /rules/rule120612v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:46:57 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:46:57 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 471
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT
                                                        ETag: "0x8DC582BB10C598B"
                                                        x-ms-request-id: 73fc0cc0-d01e-008e-5fee-16387a000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184657Z-1657d5bbd48jwrqbupe3ktsx9w000000044g000000006srs
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:46:57 UTC471INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        22192.168.2.46017413.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:46:57 UTC192OUTGET /rules/rule120610v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:46:57 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:46:57 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 474
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT
                                                        ETag: "0x8DC582B9964B277"
                                                        x-ms-request-id: 3ea0840d-701e-0053-1012-173a0a000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184657Z-1657d5bbd48xdq5dkwwugdpzr0000000041g000000016419
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:46:57 UTC474INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        23192.168.2.46017713.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:46:57 UTC192OUTGET /rules/rule120613v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:46:57 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:46:57 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 632
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT
                                                        ETag: "0x8DC582BB6E3779E"
                                                        x-ms-request-id: 15158de7-401e-0029-4b00-179b43000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184657Z-1657d5bbd48dfrdj7px744zp8s00000003rg0000000008kw
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:46:57 UTC632INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        24192.168.2.46018013.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:46:58 UTC192OUTGET /rules/rule120617v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:46:58 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:46:58 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 427
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT
                                                        ETag: "0x8DC582BA310DA18"
                                                        x-ms-request-id: 915c1ee4-001e-0079-3000-1712e8000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184658Z-1657d5bbd482lxwq1dp2t1zwkc00000003rg0000000002at
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:46:58 UTC427INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        25192.168.2.46017913.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:46:58 UTC192OUTGET /rules/rule120615v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:46:58 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:46:58 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 407
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT
                                                        ETag: "0x8DC582BBAD04B7B"
                                                        x-ms-request-id: 789c8418-601e-0032-5905-17eebb000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184658Z-1657d5bbd48t66tjar5xuq22r800000003rg00000000zm6z
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:46:58 UTC407INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        26192.168.2.46018213.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:46:58 UTC192OUTGET /rules/rule120618v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:46:58 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:46:58 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 486
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT
                                                        ETag: "0x8DC582B9018290B"
                                                        x-ms-request-id: bf7deccb-401e-0064-0f0e-1754af000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184658Z-1657d5bbd48vlsxxpe15ac3q7n00000003w000000000cf4w
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:46:58 UTC486INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        27192.168.2.46018313.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:46:58 UTC192OUTGET /rules/rule120619v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:46:58 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:46:58 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 407
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT
                                                        ETag: "0x8DC582B9698189B"
                                                        x-ms-request-id: 99ffd5e0-b01e-0053-0101-17cdf8000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184658Z-1657d5bbd482krtfgrg72dfbtn00000003mg00000000frd7
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:46:58 UTC407INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        28192.168.2.46018113.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:46:58 UTC192OUTGET /rules/rule120616v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:46:58 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:46:58 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 486
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT
                                                        ETag: "0x8DC582BB344914B"
                                                        x-ms-request-id: 0a3893d3-c01e-0082-33ee-16af72000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184658Z-1657d5bbd48lknvp09v995n79000000003k0000000007xw7
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:46:58 UTC486INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        29192.168.2.46018513.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:46:59 UTC192OUTGET /rules/rule120621v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:46:59 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:46:59 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 415
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT
                                                        ETag: "0x8DC582BA41997E3"
                                                        x-ms-request-id: 27ba9a72-001e-0046-2a01-17da4b000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184659Z-1657d5bbd48dfrdj7px744zp8s00000003n000000000eyh0
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:46:59 UTC415INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        30192.168.2.46018613.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:46:59 UTC192OUTGET /rules/rule120622v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:46:59 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:46:59 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 477
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT
                                                        ETag: "0x8DC582BB8CEAC16"
                                                        x-ms-request-id: c2d0a885-201e-0003-7ced-16f85a000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184659Z-1657d5bbd482lxwq1dp2t1zwkc00000003m000000000nnu2
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:46:59 UTC477INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        31192.168.2.46018813.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:46:59 UTC192OUTGET /rules/rule120624v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:46:59 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:46:59 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 494
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT
                                                        ETag: "0x8DC582BB7010D66"
                                                        x-ms-request-id: d3d0b776-b01e-003d-1803-17d32c000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184659Z-1657d5bbd4824mj9d6vp65b6n4000000040g00000000s5gc
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:46:59 UTC494INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        32192.168.2.46018413.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:46:59 UTC192OUTGET /rules/rule120620v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:46:59 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:46:59 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 469
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT
                                                        ETag: "0x8DC582BBA701121"
                                                        x-ms-request-id: e72ec3ca-501e-005b-2401-17d7f7000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184659Z-1657d5bbd48lknvp09v995n79000000003kg0000000054z2
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:46:59 UTC469INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        33192.168.2.46018713.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:46:59 UTC192OUTGET /rules/rule120623v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:46:59 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:46:59 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 464
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT
                                                        ETag: "0x8DC582B97FB6C3C"
                                                        x-ms-request-id: 5a59384b-a01e-0053-3602-178603000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184659Z-1657d5bbd482krtfgrg72dfbtn00000003qg0000000049u8
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:46:59 UTC464INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        34192.168.2.46018913.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:46:59 UTC192OUTGET /rules/rule120626v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:46:59 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:46:59 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 472
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT
                                                        ETag: "0x8DC582B9DACDF62"
                                                        x-ms-request-id: 20b36261-201e-006e-7102-17bbe3000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184659Z-1657d5bbd48sqtlf1huhzuwq7000000003m000000000k41p
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:46:59 UTC472INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        35192.168.2.46019213.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:46:59 UTC192OUTGET /rules/rule120628v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:46:59 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:46:59 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 468
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT
                                                        ETag: "0x8DC582B9C8E04C8"
                                                        x-ms-request-id: 81e42967-c01e-0014-5ee9-16a6a3000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184659Z-1657d5bbd48762wn1qw4s5sd3000000003r000000000k4xv
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:46:59 UTC468INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        36192.168.2.46019113.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:46:59 UTC192OUTGET /rules/rule120625v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:46:59 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:46:59 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 419
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT
                                                        ETag: "0x8DC582B9748630E"
                                                        x-ms-request-id: 3c22684b-b01e-0084-63e7-18d736000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184659Z-1657d5bbd48gqrfwecymhhbfm800000002q000000000gksz
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:46:59 UTC419INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        37192.168.2.46019013.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:46:59 UTC192OUTGET /rules/rule120627v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:46:59 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:46:59 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 404
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT
                                                        ETag: "0x8DC582B9E8EE0F3"
                                                        x-ms-request-id: f57b7c9f-801e-00a0-4a13-172196000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184659Z-1657d5bbd48cpbzgkvtewk0wu00000000420000000001aka
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:46:59 UTC404INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        38192.168.2.46019313.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:46:59 UTC192OUTGET /rules/rule120629v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:00 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:46:59 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 428
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT
                                                        ETag: "0x8DC582BAC4F34CA"
                                                        x-ms-request-id: 6be05283-001e-00a2-2700-17d4d5000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184659Z-1657d5bbd48xlwdx82gahegw4000000003z000000000yrz4
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:00 UTC428INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        39192.168.2.46019413.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:00 UTC192OUTGET /rules/rule120630v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:00 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:00 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 499
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT
                                                        ETag: "0x8DC582B98CEC9F6"
                                                        x-ms-request-id: 40323690-a01e-0002-0100-175074000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184700Z-1657d5bbd48762wn1qw4s5sd3000000003r000000000k4z4
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:00 UTC499INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        40192.168.2.46019613.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:00 UTC192OUTGET /rules/rule120632v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:00 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:00 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 471
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT
                                                        ETag: "0x8DC582BB5815C4C"
                                                        x-ms-request-id: 7cec3a6f-e01e-0033-3414-174695000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184700Z-1657d5bbd48cpbzgkvtewk0wu000000003x000000000rmvq
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:00 UTC471INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        41192.168.2.46019813.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:00 UTC192OUTGET /rules/rule120634v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:00 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:00 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 494
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT
                                                        ETag: "0x8DC582BB8972972"
                                                        x-ms-request-id: 7c825ef0-601e-0001-5f02-17faeb000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184700Z-1657d5bbd48jwrqbupe3ktsx9w00000003y0000000014dhs
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:00 UTC494INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        42192.168.2.46019513.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:00 UTC192OUTGET /rules/rule120631v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:00 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:00 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 415
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT
                                                        ETag: "0x8DC582B988EBD12"
                                                        x-ms-request-id: c530354f-501e-0016-5013-17181b000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184700Z-1657d5bbd48sqtlf1huhzuwq7000000003k000000000qa70
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:00 UTC415INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        43192.168.2.46019713.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:00 UTC192OUTGET /rules/rule120633v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:00 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:00 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 419
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT
                                                        ETag: "0x8DC582BB32BB5CB"
                                                        x-ms-request-id: ad400b52-801e-008f-58ac-182c5d000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184700Z-1657d5bbd48hzllksrq1r6zsvs000000014g00000000a1s9
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:00 UTC419INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        44192.168.2.46019913.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:01 UTC192OUTGET /rules/rule120635v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:01 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:01 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 420
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT
                                                        ETag: "0x8DC582B9DAE3EC0"
                                                        x-ms-request-id: 10df1352-f01e-00aa-105a-178521000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184701Z-1657d5bbd48762wn1qw4s5sd3000000003q000000000rr63
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:01 UTC420INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        45192.168.2.46020013.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:01 UTC192OUTGET /rules/rule120636v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:01 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:01 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 472
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT
                                                        ETag: "0x8DC582B9D43097E"
                                                        x-ms-request-id: b27116a7-a01e-003d-3a00-1798d7000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184701Z-1657d5bbd487nf59mzf5b3gk8n00000003hg000000009b37
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:01 UTC472INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        46192.168.2.46020313.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:01 UTC192OUTGET /rules/rule120639v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:01 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:01 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 423
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT
                                                        ETag: "0x8DC582BB7564CE8"
                                                        x-ms-request-id: a2d01d3c-801e-0083-4800-17f0ae000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184701Z-1657d5bbd48dfrdj7px744zp8s00000003q0000000006qsp
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:01 UTC423INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        47192.168.2.46020113.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:01 UTC192OUTGET /rules/rule120637v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:01 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:01 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 427
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT
                                                        ETag: "0x8DC582BA909FA21"
                                                        x-ms-request-id: a62739ea-301e-005d-6402-17e448000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184701Z-1657d5bbd48sdh4cyzadbb374800000003m000000000zbpx
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:01 UTC427INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        48192.168.2.46020213.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:01 UTC192OUTGET /rules/rule120638v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:01 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:01 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 486
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT
                                                        ETag: "0x8DC582B92FCB436"
                                                        x-ms-request-id: b8f8ddc8-601e-0001-115a-17faeb000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184701Z-1657d5bbd48xsz2nuzq4vfrzg800000003n000000000z8ar
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:01 UTC486INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        49192.168.2.46020513.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:02 UTC192OUTGET /rules/rule120640v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:02 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:02 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 478
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT
                                                        ETag: "0x8DC582B9B233827"
                                                        x-ms-request-id: 4dd19665-401e-005b-7705-179c0c000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184702Z-1657d5bbd48762wn1qw4s5sd3000000003u00000000053uh
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:02 UTC478INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        50192.168.2.46020613.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:02 UTC192OUTGET /rules/rule120641v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:02 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:02 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 404
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT
                                                        ETag: "0x8DC582B95C61A3C"
                                                        x-ms-request-id: 151ca1e1-401e-0029-2b03-179b43000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184702Z-1657d5bbd4824mj9d6vp65b6n4000000043000000000de1w
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:02 UTC404INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        51192.168.2.46020813.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:02 UTC192OUTGET /rules/rule120643v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:02 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:02 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 400
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT
                                                        ETag: "0x8DC582BB2D62837"
                                                        x-ms-request-id: 11b227e2-601e-0002-7f6b-17a786000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184702Z-1657d5bbd482lxwq1dp2t1zwkc00000003ng00000000dh9z
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:02 UTC400INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        52192.168.2.46020713.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:02 UTC192OUTGET /rules/rule120642v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:02 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:02 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 468
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT
                                                        ETag: "0x8DC582BB046B576"
                                                        x-ms-request-id: db28b7eb-d01e-0065-5efe-16b77a000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184702Z-1657d5bbd48jwrqbupe3ktsx9w00000003zg00000000yc5m
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:02 UTC468INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        53192.168.2.46020913.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:02 UTC192OUTGET /rules/rule120644v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:02 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:02 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 479
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT
                                                        ETag: "0x8DC582BB7D702D0"
                                                        x-ms-request-id: b2c548d6-d01e-0082-4f03-17e489000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184702Z-1657d5bbd48qjg85buwfdynm5w00000003vg00000000xmt5
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:02 UTC479INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        54192.168.2.46021113.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:02 UTC192OUTGET /rules/rule120646v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:02 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:02 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 475
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT
                                                        ETag: "0x8DC582BB2BE84FD"
                                                        x-ms-request-id: c5dbf9be-001e-0017-2cf1-160c3c000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184702Z-1657d5bbd48sqtlf1huhzuwq7000000003n000000000cvgx
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:02 UTC475INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        55192.168.2.46021213.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:02 UTC192OUTGET /rules/rule120647v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:02 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:02 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 448
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT
                                                        ETag: "0x8DC582BB389F49B"
                                                        x-ms-request-id: 5a5a1e5c-a01e-001e-18f5-1649ef000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184702Z-1657d5bbd48xsz2nuzq4vfrzg800000003t00000000090nf
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:02 UTC448INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        56192.168.2.46021013.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:02 UTC192OUTGET /rules/rule120645v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:02 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:02 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 425
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT
                                                        ETag: "0x8DC582BBA25094F"
                                                        x-ms-request-id: 7709e3c3-b01e-0097-5e02-174f33000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184702Z-1657d5bbd48wd55zet5pcra0cg00000003y0000000002wr0
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:02 UTC425INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        57192.168.2.46021313.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:02 UTC192OUTGET /rules/rule120648v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:02 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:02 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 491
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT
                                                        ETag: "0x8DC582B98B88612"
                                                        x-ms-request-id: 721d8bd8-801e-002a-4f00-1731dc000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184702Z-1657d5bbd48gqrfwecymhhbfm800000002t00000000045kd
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:02 UTC491INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        58192.168.2.46021413.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:02 UTC192OUTGET /rules/rule120649v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:02 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:02 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 416
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT
                                                        ETag: "0x8DC582BAEA4B445"
                                                        x-ms-request-id: cb78c1b2-201e-003f-2e04-176d94000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184702Z-1657d5bbd48xlwdx82gahegw400000000440000000007s2u
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:02 UTC416INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        59192.168.2.46021513.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:03 UTC192OUTGET /rules/rule120650v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:03 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:03 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 479
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT
                                                        ETag: "0x8DC582B989EE75B"
                                                        x-ms-request-id: 27b6de9f-001e-0046-1e00-17da4b000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184703Z-1657d5bbd48vhs7r2p1ky7cs5w000000043000000000vsc5
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:03 UTC479INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        60192.168.2.46021613.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:03 UTC192OUTGET /rules/rule120651v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:03 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:03 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 415
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT
                                                        ETag: "0x8DC582BA80D96A1"
                                                        x-ms-request-id: cc92db4a-701e-0053-3460-173a0a000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184703Z-1657d5bbd48gqrfwecymhhbfm800000002mg00000000v5uq
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:03 UTC415INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        61192.168.2.46021713.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:03 UTC192OUTGET /rules/rule120652v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:03 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:03 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 471
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT
                                                        ETag: "0x8DC582B97E6FCDD"
                                                        x-ms-request-id: 2f3972b1-401e-0035-1b02-1782d8000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184703Z-1657d5bbd48xlwdx82gahegw40000000041g00000000n0s9
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:03 UTC471INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        62192.168.2.46021813.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:03 UTC192OUTGET /rules/rule120653v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:03 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:03 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 419
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT
                                                        ETag: "0x8DC582B9C710B28"
                                                        x-ms-request-id: 1ed82642-401e-0048-7b12-170409000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184703Z-1657d5bbd487nf59mzf5b3gk8n00000003d000000000vd32
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:03 UTC419INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        63192.168.2.46021913.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:03 UTC192OUTGET /rules/rule120654v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:03 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:03 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 477
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT
                                                        ETag: "0x8DC582BA54DCC28"
                                                        x-ms-request-id: cde3aec9-601e-0084-63e5-166b3f000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184703Z-1657d5bbd482tlqpvyz9e93p5400000003vg00000000vq7y
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:03 UTC477INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        64192.168.2.46022013.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:04 UTC192OUTGET /rules/rule120655v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:04 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:04 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 419
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT
                                                        ETag: "0x8DC582BB7F164C3"
                                                        x-ms-request-id: 3a03d6b9-d01e-0066-52e9-16ea17000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184704Z-1657d5bbd4824mj9d6vp65b6n400000003zg00000000xhca
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:04 UTC419INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        65192.168.2.46022113.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:04 UTC192OUTGET /rules/rule120656v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:04 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:04 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 477
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT
                                                        ETag: "0x8DC582BA48B5BDD"
                                                        x-ms-request-id: c367bd92-c01e-002b-14e8-186e00000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184704Z-1657d5bbd48f7nlxc7n5fnfzh000000003mg000000001ryg
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:04 UTC477INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        66192.168.2.46022213.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:04 UTC192OUTGET /rules/rule120657v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:04 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:04 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 419
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT
                                                        ETag: "0x8DC582B9FF95F80"
                                                        x-ms-request-id: 46a5aa72-701e-0032-6004-17a540000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184704Z-1657d5bbd48vlsxxpe15ac3q7n00000003ug00000000m7wp
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:04 UTC419INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        67192.168.2.46022313.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:04 UTC192OUTGET /rules/rule120658v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:04 UTC471INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:04 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 472
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT
                                                        ETag: "0x8DC582BB650C2EC"
                                                        x-ms-request-id: 54bb7796-c01e-000b-02e9-18e255000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184704Z-1657d5bbd48vhs7r2p1ky7cs5w0000000490000000001yt5
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_MISS
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:04 UTC472INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        68192.168.2.46022413.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:04 UTC192OUTGET /rules/rule120659v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:04 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:04 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 468
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT
                                                        ETag: "0x8DC582BB3EAF226"
                                                        x-ms-request-id: b0fdb72d-401e-0015-37ce-160e8d000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184704Z-1657d5bbd487nf59mzf5b3gk8n00000003e000000000s1zq
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:04 UTC468INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        69192.168.2.46022513.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:04 UTC192OUTGET /rules/rule120660v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:05 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:04 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 485
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT
                                                        ETag: "0x8DC582BB9769355"
                                                        x-ms-request-id: 8d3bec0a-601e-0070-32fe-16a0c9000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184704Z-1657d5bbd48f7nlxc7n5fnfzh000000003dg00000000wbau
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:05 UTC485INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        70192.168.2.46022613.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:04 UTC192OUTGET /rules/rule120661v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:05 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:05 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 411
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT
                                                        ETag: "0x8DC582B989AF051"
                                                        x-ms-request-id: 8d044b15-901e-00ac-3902-17b69e000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184705Z-1657d5bbd48gqrfwecymhhbfm800000002mg00000000v5wu
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:05 UTC411INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        71192.168.2.46022713.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:05 UTC192OUTGET /rules/rule120662v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:05 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:05 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 470
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT
                                                        ETag: "0x8DC582BBB181F65"
                                                        x-ms-request-id: e72b6989-501e-005b-2b00-17d7f7000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184705Z-1657d5bbd482lxwq1dp2t1zwkc00000003ng00000000dhf7
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:05 UTC470INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        72192.168.2.46022813.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:05 UTC192OUTGET /rules/rule120663v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:05 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:05 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 427
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT
                                                        ETag: "0x8DC582BB556A907"
                                                        x-ms-request-id: 0377c3fc-101e-000b-65dc-165e5c000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184705Z-1657d5bbd482tlqpvyz9e93p5400000003vg00000000vqkx
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:05 UTC427INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        73192.168.2.46022913.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:05 UTC192OUTGET /rules/rule120664v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:05 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:05 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 502
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT
                                                        ETag: "0x8DC582BB6A0D312"
                                                        x-ms-request-id: a5e58c1d-b01e-00ab-5ac9-16dafd000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184705Z-1657d5bbd48cpbzgkvtewk0wu000000003y000000000hvhp
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:05 UTC502INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        74192.168.2.46023013.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:05 UTC192OUTGET /rules/rule120665v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:05 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:05 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 407
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT
                                                        ETag: "0x8DC582B9D30478D"
                                                        x-ms-request-id: 78a0432a-701e-001e-1805-17f5e6000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184705Z-1657d5bbd48tqvfc1ysmtbdrg000000003p000000000udbs
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:05 UTC407INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        75192.168.2.46023113.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:05 UTC192OUTGET /rules/rule120666v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:05 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:05 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 474
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT
                                                        ETag: "0x8DC582BB3F48DAE"
                                                        x-ms-request-id: ef9cab6f-f01e-0099-0d00-179171000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184705Z-1657d5bbd482lxwq1dp2t1zwkc00000003m000000000np6s
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:05 UTC474INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        76192.168.2.46023213.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:05 UTC192OUTGET /rules/rule120667v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:05 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:05 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 408
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT
                                                        ETag: "0x8DC582BB9B6040B"
                                                        x-ms-request-id: 2f519f63-901e-0016-75ff-16efe9000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184705Z-1657d5bbd48sqtlf1huhzuwq7000000003qg0000000025p7
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:05 UTC408INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        77192.168.2.46023313.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:05 UTC192OUTGET /rules/rule120668v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:05 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:05 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 469
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT
                                                        ETag: "0x8DC582BB3CAEBB8"
                                                        x-ms-request-id: b67c2655-301e-0096-2300-17e71d000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184705Z-1657d5bbd48vlsxxpe15ac3q7n00000003s000000000x3a7
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:05 UTC469INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        78192.168.2.46023413.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:05 UTC192OUTGET /rules/rule120669v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:05 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:05 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 416
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT
                                                        ETag: "0x8DC582BB5284CCE"
                                                        x-ms-request-id: 821e4157-c01e-0014-3301-17a6a3000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184705Z-1657d5bbd48jwrqbupe3ktsx9w000000045g0000000023bs
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:05 UTC416INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        79192.168.2.46023613.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:06 UTC192OUTGET /rules/rule120670v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:06 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:06 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 472
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT
                                                        ETag: "0x8DC582B91EAD002"
                                                        x-ms-request-id: 763e8d43-601e-000d-6912-172618000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184706Z-1657d5bbd48sdh4cyzadbb374800000003t0000000006wt4
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:06 UTC472INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        80192.168.2.46023713.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:06 UTC192OUTGET /rules/rule120671v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:06 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:06 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 432
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT
                                                        ETag: "0x8DC582BAABA2A10"
                                                        x-ms-request-id: 897bc565-f01e-0096-5e60-1710ef000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184706Z-1657d5bbd487nf59mzf5b3gk8n00000003c000000001057v
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:06 UTC432INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        81192.168.2.46023813.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:06 UTC192OUTGET /rules/rule120672v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:06 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:06 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 475
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT
                                                        ETag: "0x8DC582BBA740822"
                                                        x-ms-request-id: 01bf113a-f01e-003c-3703-178cf0000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184706Z-1657d5bbd48t66tjar5xuq22r800000003vg00000000e5mv
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:06 UTC475INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        82192.168.2.46023913.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:06 UTC192OUTGET /rules/rule120673v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:06 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:06 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 427
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT
                                                        ETag: "0x8DC582BB464F255"
                                                        x-ms-request-id: 7875ffac-201e-000c-7f02-1779c4000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184706Z-1657d5bbd482tlqpvyz9e93p5400000003vg00000000vqsq
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:06 UTC427INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        83192.168.2.46024013.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:06 UTC192OUTGET /rules/rule120674v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:06 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:06 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 474
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT
                                                        ETag: "0x8DC582BA4037B0D"
                                                        x-ms-request-id: 3b7b7106-501e-0064-43e7-161f54000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184706Z-1657d5bbd487nf59mzf5b3gk8n00000003d000000000vd76
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:06 UTC474INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        84192.168.2.46024213.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:07 UTC192OUTGET /rules/rule120676v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:07 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:07 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 472
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT
                                                        ETag: "0x8DC582B984BF177"
                                                        x-ms-request-id: 2f576d96-401e-0047-3902-178597000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184707Z-1657d5bbd482krtfgrg72dfbtn00000003n000000000f1fb
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:07 UTC472INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        85192.168.2.46024113.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:07 UTC192OUTGET /rules/rule120675v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:07 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:07 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 419
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT
                                                        ETag: "0x8DC582BA6CF78C8"
                                                        x-ms-request-id: 3c7823fd-401e-0015-0c60-170e8d000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184707Z-1657d5bbd48dfrdj7px744zp8s00000003p000000000b517
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:07 UTC419INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        86192.168.2.46024313.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:07 UTC192OUTGET /rules/rule120677v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:07 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:07 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 405
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT
                                                        ETag: "0x8DC582B942B6AFF"
                                                        x-ms-request-id: dfb96d6a-f01e-003f-17e5-16d19d000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184707Z-1657d5bbd48qjg85buwfdynm5w00000003w000000000vvy9
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:07 UTC405INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        87192.168.2.46024413.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:07 UTC192OUTGET /rules/rule120678v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:07 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:07 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 468
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT
                                                        ETag: "0x8DC582BBA642BF4"
                                                        x-ms-request-id: f5ee0945-901e-0083-4202-17bb55000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184707Z-1657d5bbd48vlsxxpe15ac3q7n00000003z000000000060c
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:07 UTC468INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        88192.168.2.46024513.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:07 UTC192OUTGET /rules/rule120679v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:07 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:07 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 174
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT
                                                        ETag: "0x8DC582B91D80E15"
                                                        x-ms-request-id: 0607cd43-401e-0078-1b00-174d34000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184707Z-1657d5bbd48jwrqbupe3ktsx9w000000040000000000vys0
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:07 UTC174INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        89192.168.2.46024613.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:07 UTC192OUTGET /rules/rule120680v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:08 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:07 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1952
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT
                                                        ETag: "0x8DC582B956B0F3D"
                                                        x-ms-request-id: a5ff6bd9-301e-005d-3af2-16e448000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184707Z-1657d5bbd48q6t9vvmrkd293mg00000003w000000000bfze
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:08 UTC1952INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        90192.168.2.46024713.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:08 UTC192OUTGET /rules/rule120681v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:08 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:08 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 958
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT
                                                        ETag: "0x8DC582BA0A31B3B"
                                                        x-ms-request-id: 0c165d1d-a01e-000d-7dfe-16d1ea000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184708Z-1657d5bbd48jwrqbupe3ktsx9w0000000440000000008u1k
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:08 UTC958INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        91192.168.2.46024813.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:08 UTC192OUTGET /rules/rule120682v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:08 UTC470INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:08 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 501
                                                        Connection: close
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT
                                                        ETag: "0x8DC582BACFDAACD"
                                                        x-ms-request-id: c2f609cb-201e-0003-75fd-16f85a000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184708Z-1657d5bbd48brl8we3nu8cxwgn000000046g00000000cr06
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:08 UTC501INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        92192.168.2.46024913.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:08 UTC193OUTGET /rules/rule120602v10s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:08 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:08 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 2592
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT
                                                        ETag: "0x8DC582BB5B890DB"
                                                        x-ms-request-id: 33b4d0ae-a01e-0032-35ff-161949000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184708Z-1657d5bbd48xdq5dkwwugdpzr0000000047g00000000953y
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:08 UTC2592INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        93192.168.2.46025013.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:08 UTC192OUTGET /rules/rule120601v3s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:08 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:08 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 3342
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT
                                                        ETag: "0x8DC582B927E47E9"
                                                        x-ms-request-id: 960edd56-701e-005c-4100-17bb94000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184708Z-1657d5bbd48wd55zet5pcra0cg00000003ug00000000hz9d
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:08 UTC3342INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        94192.168.2.46025113.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:08 UTC193OUTGET /rules/rule224901v11s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:08 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:08 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 2284
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT
                                                        ETag: "0x8DC582BCD58BEEE"
                                                        x-ms-request-id: b738acd5-401e-0067-1502-1709c2000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184708Z-1657d5bbd487nf59mzf5b3gk8n00000003hg000000009bsf
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:08 UTC2284INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        95192.168.2.46025313.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:08 UTC192OUTGET /rules/rule701200v1s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:09 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:08 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1356
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT
                                                        ETag: "0x8DC582BDC681E17"
                                                        x-ms-request-id: 0480ed94-801e-00ac-5102-17fd65000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184708Z-1657d5bbd48sqtlf1huhzuwq7000000003h000000000tv3h
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:09 UTC1356INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        96192.168.2.46025213.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:08 UTC192OUTGET /rules/rule701201v1s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:08 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:08 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1393
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT
                                                        ETag: "0x8DC582BE3E55B6E"
                                                        x-ms-request-id: 8a5fd43d-c01e-0066-4506-17a1ec000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184708Z-1657d5bbd48wd55zet5pcra0cg00000003w000000000ba7b
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:08 UTC1393INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        97192.168.2.46025413.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:09 UTC192OUTGET /rules/rule700201v1s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:09 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:09 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1393
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT
                                                        ETag: "0x8DC582BE39DFC9B"
                                                        x-ms-request-id: b72ef555-401e-0067-78fe-1609c2000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184709Z-1657d5bbd482lxwq1dp2t1zwkc00000003m000000000npef
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:09 UTC1393INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        98192.168.2.46025513.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:09 UTC192OUTGET /rules/rule700200v1s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:09 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:09 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1356
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT
                                                        ETag: "0x8DC582BDF66E42D"
                                                        x-ms-request-id: db28c537-d01e-0065-47fe-16b77a000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184709Z-1657d5bbd48xdq5dkwwugdpzr0000000046g00000000deyz
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:09 UTC1356INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        99192.168.2.46025613.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:09 UTC192OUTGET /rules/rule701251v1s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:09 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:09 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1395
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT
                                                        ETag: "0x8DC582BDE12A98D"
                                                        x-ms-request-id: 03c3f781-101e-000b-56fe-165e5c000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184709Z-1657d5bbd48xdq5dkwwugdpzr0000000042g000000010tk0
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:09 UTC1395INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        100192.168.2.46025813.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:09 UTC192OUTGET /rules/rule702350v1s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:09 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:09 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1358
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT
                                                        ETag: "0x8DC582BE6431446"
                                                        x-ms-request-id: 84e7aa3f-c01e-008e-74ff-167381000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184709Z-1657d5bbd48gqrfwecymhhbfm800000002pg00000000kkt1
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:09 UTC1358INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        101192.168.2.46025713.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:09 UTC192OUTGET /rules/rule702351v1s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:09 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:09 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1395
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT
                                                        ETag: "0x8DC582BE017CAD3"
                                                        x-ms-request-id: cb759915-201e-003f-5f03-176d94000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184709Z-1657d5bbd48gqrfwecymhhbfm800000002pg00000000kkt2
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:09 UTC1395INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        102192.168.2.46025913.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:09 UTC192OUTGET /rules/rule701250v1s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:09 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:09 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1358
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT
                                                        ETag: "0x8DC582BE022ECC5"
                                                        x-ms-request-id: 76165599-601e-000d-1a02-172618000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184709Z-1657d5bbd482krtfgrg72dfbtn00000003m000000000hrbr
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:09 UTC1358INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        103192.168.2.46026013.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:09 UTC192OUTGET /rules/rule700051v1s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:09 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:09 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1389
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT
                                                        ETag: "0x8DC582BE10A6BC1"
                                                        x-ms-request-id: 29f28342-e01e-003c-5d00-17c70b000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184709Z-1657d5bbd4824mj9d6vp65b6n400000003zg00000000xht8
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:09 UTC1389INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        104192.168.2.46026213.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:10 UTC192OUTGET /rules/rule702951v1s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:10 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:10 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1405
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT
                                                        ETag: "0x8DC582BE12B5C71"
                                                        x-ms-request-id: 6f1c5b1d-901e-0048-485a-17b800000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184710Z-1657d5bbd48gqrfwecymhhbfm800000002pg00000000kku4
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:10 UTC1405INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        105192.168.2.46026113.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:10 UTC192OUTGET /rules/rule700050v1s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:10 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:10 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1352
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT
                                                        ETag: "0x8DC582BE9DEEE28"
                                                        x-ms-request-id: a9a45936-c01e-00a1-54f1-167e4a000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184710Z-1657d5bbd48xlwdx82gahegw4000000003zg00000000w9xd
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:10 UTC1352INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        106192.168.2.46026513.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:10 UTC192OUTGET /rules/rule701150v1s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:10 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:10 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1364
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT
                                                        ETag: "0x8DC582BE1223606"
                                                        x-ms-request-id: 04600955-801e-00ac-55f4-16fd65000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184710Z-1657d5bbd48f7nlxc7n5fnfzh000000003f000000000q19k
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:10 UTC1364INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        107192.168.2.46026313.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:10 UTC192OUTGET /rules/rule702950v1s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:10 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:10 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1368
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT
                                                        ETag: "0x8DC582BDDC22447"
                                                        x-ms-request-id: 173e0f62-801e-00a3-24fe-167cfb000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184710Z-1657d5bbd48sdh4cyzadbb374800000003t0000000006x2z
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:10 UTC1368INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        108192.168.2.46026413.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:10 UTC192OUTGET /rules/rule701151v1s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:10 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:10 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1401
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT
                                                        ETag: "0x8DC582BE055B528"
                                                        x-ms-request-id: 6bee43b5-001e-00a2-2106-17d4d5000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184710Z-1657d5bbd48cpbzgkvtewk0wu000000003x000000000rnh7
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:10 UTC1401INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        109192.168.2.46026713.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:11 UTC192OUTGET /rules/rule702200v1s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:11 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:11 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1360
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT
                                                        ETag: "0x8DC582BDDEB5124"
                                                        x-ms-request-id: 62f7f1ae-f01e-0096-4d0c-1710ef000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184711Z-1657d5bbd48cpbzgkvtewk0wu0000000041g000000003kqk
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:11 UTC1360INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        110192.168.2.46026613.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:11 UTC192OUTGET /rules/rule702201v1s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:11 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:11 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1397
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT
                                                        ETag: "0x8DC582BE7262739"
                                                        x-ms-request-id: 4035d6e2-a01e-0002-4602-175074000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184711Z-1657d5bbd48sqtlf1huhzuwq7000000003h000000000tv9e
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:11 UTC1397INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        111192.168.2.46026813.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:11 UTC192OUTGET /rules/rule700401v2s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:11 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:11 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1403
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT
                                                        ETag: "0x8DC582BDCB4853F"
                                                        x-ms-request-id: 87e26173-201e-0051-15e7-167340000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184711Z-1657d5bbd487nf59mzf5b3gk8n00000003c00000000105kh
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:11 UTC1403INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        112192.168.2.46027013.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:11 UTC192OUTGET /rules/rule700351v1s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:11 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:11 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1397
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT
                                                        ETag: "0x8DC582BDFD43C07"
                                                        x-ms-request-id: 31868579-401e-008c-0af2-1686c2000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184711Z-1657d5bbd48jwrqbupe3ktsx9w000000043g00000000bmhn
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:11 UTC1397INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        113192.168.2.46026913.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:11 UTC192OUTGET /rules/rule700400v2s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:11 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:11 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1366
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT
                                                        ETag: "0x8DC582BDB779FC3"
                                                        x-ms-request-id: e8bf9cf6-101e-007a-0bac-18047e000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184711Z-1657d5bbd48hzllksrq1r6zsvs000000013g00000000dtv4
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:11 UTC1366INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        114192.168.2.46027213.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:11 UTC192OUTGET /rules/rule703901v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:12 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:11 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1427
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT
                                                        ETag: "0x8DC582BE56F6873"
                                                        x-ms-request-id: 08bf7a15-f01e-0020-7706-17956b000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184711Z-1657d5bbd48tnj6wmberkg2xy800000003wg00000000su9p
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:12 UTC1427INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        115192.168.2.46027313.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:12 UTC192OUTGET /rules/rule703900v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:12 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:12 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1390
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT
                                                        ETag: "0x8DC582BE3002601"
                                                        x-ms-request-id: 7d21ea5d-701e-0098-0502-17395f000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184712Z-1657d5bbd482krtfgrg72dfbtn00000003p0000000009y9x
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:12 UTC1390INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        116192.168.2.46027413.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:12 UTC192OUTGET /rules/rule701501v1s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:12 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:12 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1401
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT
                                                        ETag: "0x8DC582BE2A9D541"
                                                        x-ms-request-id: b6fa471e-401e-0067-43e5-1609c2000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184712Z-1657d5bbd48dfrdj7px744zp8s00000003m000000000m3bz
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:12 UTC1401INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        117192.168.2.46027513.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:12 UTC192OUTGET /rules/rule701500v1s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:12 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:12 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1364
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT
                                                        ETag: "0x8DC582BEB6AD293"
                                                        x-ms-request-id: 77012b0e-b01e-0097-0bff-164f33000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184712Z-1657d5bbd48jwrqbupe3ktsx9w00000003z00000000104vu
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:12 UTC1364INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        118192.168.2.46027613.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:12 UTC192OUTGET /rules/rule702801v1s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:12 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:12 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1391
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT
                                                        ETag: "0x8DC582BDF58DC7E"
                                                        x-ms-request-id: a18d9b1d-601e-0002-1f03-17a786000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184712Z-1657d5bbd48762wn1qw4s5sd3000000003tg0000000079g9
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:12 UTC1391INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        119192.168.2.46027713.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:12 UTC192OUTGET /rules/rule702800v1s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:12 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:12 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1354
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT
                                                        ETag: "0x8DC582BE0662D7C"
                                                        x-ms-request-id: d4fd285a-d01e-005a-06ed-167fd9000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184712Z-1657d5bbd48dfrdj7px744zp8s00000003qg000000004by1
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:12 UTC1354INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        120192.168.2.46027813.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:12 UTC192OUTGET /rules/rule703351v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:12 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:12 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1403
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT
                                                        ETag: "0x8DC582BDCDD6400"
                                                        x-ms-request-id: 4d5cca78-701e-0021-6ae5-163d45000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184712Z-1657d5bbd48sdh4cyzadbb374800000003q000000000kvkm
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:12 UTC1403INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        121192.168.2.46027913.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:12 UTC192OUTGET /rules/rule703350v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:12 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:12 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1366
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT
                                                        ETag: "0x8DC582BDF1E2608"
                                                        x-ms-request-id: c9f5ea47-201e-0071-33fe-16ff15000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184712Z-1657d5bbd48xsz2nuzq4vfrzg800000003pg00000000scq7
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:12 UTC1366INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        122192.168.2.46028113.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:13 UTC192OUTGET /rules/rule703501v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:13 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:13 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1399
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT
                                                        ETag: "0x8DC582BE8C605FF"
                                                        x-ms-request-id: 635e2ff4-801e-0035-1973-17752a000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184713Z-1657d5bbd48f7nlxc7n5fnfzh000000003hg00000000a7sx
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:13 UTC1399INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        123192.168.2.46028213.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:13 UTC192OUTGET /rules/rule703500v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:13 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:13 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1362
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT
                                                        ETag: "0x8DC582BDF497570"
                                                        x-ms-request-id: 838d785c-001e-0014-24fe-165151000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184713Z-1657d5bbd48qjg85buwfdynm5w000000040000000000afxm
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:13 UTC1362INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        124192.168.2.46028313.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:13 UTC192OUTGET /rules/rule701801v1s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:13 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:13 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1403
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT
                                                        ETag: "0x8DC582BDC2EEE03"
                                                        x-ms-request-id: 4d8e5842-701e-0021-0efe-163d45000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184713Z-1657d5bbd48vlsxxpe15ac3q7n00000003y0000000004929
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:13 UTC1403INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        125192.168.2.46028413.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:13 UTC192OUTGET /rules/rule701800v1s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:13 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:13 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1366
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT
                                                        ETag: "0x8DC582BEA414B16"
                                                        x-ms-request-id: 8a56303a-c01e-0066-0f01-17a1ec000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184713Z-1657d5bbd48cpbzgkvtewk0wu000000003v000000000yv12
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:13 UTC1366INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        126192.168.2.46027113.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:14 UTC192OUTGET /rules/rule700350v1s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:14 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:14 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1360
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT
                                                        ETag: "0x8DC582BDD74D2EC"
                                                        x-ms-request-id: fbb49b00-e01e-00aa-4806-17ceda000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184714Z-1657d5bbd48brl8we3nu8cxwgn000000042g00000000yww6
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:14 UTC1360INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        127192.168.2.46028613.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:14 UTC192OUTGET /rules/rule701050v1s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:14 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:14 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1362
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT
                                                        ETag: "0x8DC582BEB256F43"
                                                        x-ms-request-id: 0c184816-a01e-000d-72ff-16d1ea000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184714Z-1657d5bbd48wd55zet5pcra0cg00000003wg000000009tf7
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:14 UTC1362INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        128192.168.2.46028713.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:14 UTC192OUTGET /rules/rule702751v1s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:14 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:14 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1403
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT
                                                        ETag: "0x8DC582BEB866CDB"
                                                        x-ms-request-id: d3a3eb01-b01e-003d-1ef1-16d32c000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184714Z-1657d5bbd48wd55zet5pcra0cg00000003vg00000000cy1d
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:14 UTC1403INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        129192.168.2.46028813.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:14 UTC192OUTGET /rules/rule702750v1s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:14 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:14 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1366
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT
                                                        ETag: "0x8DC582BE5B7B174"
                                                        x-ms-request-id: 4833e4a9-401e-0047-05a5-188597000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184714Z-1657d5bbd48hzllksrq1r6zsvs000000016g000000001sy3
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:14 UTC1366INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        130192.168.2.46028513.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:14 UTC192OUTGET /rules/rule701051v1s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:14 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:14 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1399
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT
                                                        ETag: "0x8DC582BE1CC18CD"
                                                        x-ms-request-id: cd0b82ba-d01e-0049-1304-17e7dc000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184714Z-1657d5bbd48brl8we3nu8cxwgn0000000480000000006hes
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:14 UTC1399INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        131192.168.2.460289142.250.186.784437220C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:14 UTC1338OUTPOST /log?format=json&hasfast=true&authuser=0 HTTP/1.1
                                                        Host: play.google.com
                                                        Connection: keep-alive
                                                        Content-Length: 1516
                                                        sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                                        sec-ch-ua-mobile: ?0
                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                        sec-ch-ua-arch: "x86"
                                                        Content-Type: application/x-www-form-urlencoded;charset=UTF-8
                                                        sec-ch-ua-full-version: "117.0.5938.132"
                                                        sec-ch-ua-platform-version: "10.0.0"
                                                        X-Goog-AuthUser: 0
                                                        sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"
                                                        sec-ch-ua-bitness: "64"
                                                        sec-ch-ua-model: ""
                                                        sec-ch-ua-wow64: ?0
                                                        sec-ch-ua-platform: "Windows"
                                                        Accept: */*
                                                        Origin: https://accounts.google.com
                                                        X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=
                                                        Sec-Fetch-Site: same-site
                                                        Sec-Fetch-Mode: cors
                                                        Sec-Fetch-Dest: empty
                                                        Referer: https://accounts.google.com/
                                                        Accept-Encoding: gzip, deflate, br
                                                        Accept-Language: en-US,en;q=0.9
                                                        Cookie: NID=518=cBIDocdZDNKtPWSh2XYxgbf-oOo05p2etVhWD-mvq5xn653c3R21cEDtaW3wGSphNxDDT5tLi29Ps0aTAV2vWFuHZcBL0O_-okpi4Z4ixgo0dmmSMLM1oJocNgOv21xb3Jkg23M44sfxag3tG6TmJpDnzevg34QD9GsWFWIUoLBpuFi2UXEexsaZ7P4
                                                        2024-10-07 18:47:14 UTC1516OUTData Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 33 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 38 33 32 36 38 33 33 34 38 39 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c
                                                        Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"31",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],1828,[["1728326833489",null,null,null
                                                        2024-10-07 18:47:15 UTC523INHTTP/1.1 200 OK
                                                        Access-Control-Allow-Origin: https://accounts.google.com
                                                        Cross-Origin-Resource-Policy: cross-origin
                                                        Access-Control-Allow-Credentials: true
                                                        Access-Control-Allow-Headers: X-Playlog-Web
                                                        Content-Type: text/plain; charset=UTF-8
                                                        Date: Mon, 07 Oct 2024 18:47:14 GMT
                                                        Server: Playlog
                                                        Cache-Control: private
                                                        X-XSS-Protection: 0
                                                        X-Frame-Options: SAMEORIGIN
                                                        Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                        Accept-Ranges: none
                                                        Vary: Accept-Encoding
                                                        Connection: close
                                                        Transfer-Encoding: chunked
                                                        2024-10-07 18:47:15 UTC137INData Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a
                                                        Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
                                                        2024-10-07 18:47:15 UTC5INData Raw: 30 0d 0a 0d 0a
                                                        Data Ascii: 0


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        132192.168.2.460290142.250.186.784437220C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:14 UTC1338OUTPOST /log?format=json&hasfast=true&authuser=0 HTTP/1.1
                                                        Host: play.google.com
                                                        Connection: keep-alive
                                                        Content-Length: 1454
                                                        sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                                                        sec-ch-ua-mobile: ?0
                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                        sec-ch-ua-arch: "x86"
                                                        Content-Type: application/x-www-form-urlencoded;charset=UTF-8
                                                        sec-ch-ua-full-version: "117.0.5938.132"
                                                        sec-ch-ua-platform-version: "10.0.0"
                                                        X-Goog-AuthUser: 0
                                                        sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"
                                                        sec-ch-ua-bitness: "64"
                                                        sec-ch-ua-model: ""
                                                        sec-ch-ua-wow64: ?0
                                                        sec-ch-ua-platform: "Windows"
                                                        Accept: */*
                                                        Origin: https://accounts.google.com
                                                        X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=
                                                        Sec-Fetch-Site: same-site
                                                        Sec-Fetch-Mode: cors
                                                        Sec-Fetch-Dest: empty
                                                        Referer: https://accounts.google.com/
                                                        Accept-Encoding: gzip, deflate, br
                                                        Accept-Language: en-US,en;q=0.9
                                                        Cookie: NID=518=cBIDocdZDNKtPWSh2XYxgbf-oOo05p2etVhWD-mvq5xn653c3R21cEDtaW3wGSphNxDDT5tLi29Ps0aTAV2vWFuHZcBL0O_-okpi4Z4ixgo0dmmSMLM1oJocNgOv21xb3Jkg23M44sfxag3tG6TmJpDnzevg34QD9GsWFWIUoLBpuFi2UXEexsaZ7P4
                                                        2024-10-07 18:47:14 UTC1454OUTData Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 33 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 38 33 32 36 38 33 33 35 30 35 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c
                                                        Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"31",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],1828,[["1728326833505",null,null,null
                                                        2024-10-07 18:47:15 UTC523INHTTP/1.1 200 OK
                                                        Access-Control-Allow-Origin: https://accounts.google.com
                                                        Cross-Origin-Resource-Policy: cross-origin
                                                        Access-Control-Allow-Credentials: true
                                                        Access-Control-Allow-Headers: X-Playlog-Web
                                                        Content-Type: text/plain; charset=UTF-8
                                                        Date: Mon, 07 Oct 2024 18:47:14 GMT
                                                        Server: Playlog
                                                        Cache-Control: private
                                                        X-XSS-Protection: 0
                                                        X-Frame-Options: SAMEORIGIN
                                                        Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                        Accept-Ranges: none
                                                        Vary: Accept-Encoding
                                                        Connection: close
                                                        Transfer-Encoding: chunked
                                                        2024-10-07 18:47:15 UTC137INData Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a
                                                        Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
                                                        2024-10-07 18:47:15 UTC5INData Raw: 30 0d 0a 0d 0a
                                                        Data Ascii: 0


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        133192.168.2.46029113.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:15 UTC192OUTGET /rules/rule702300v1s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:15 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:15 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1362
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT
                                                        ETag: "0x8DC582BDC13EFEF"
                                                        x-ms-request-id: 4ef38422-401e-000a-160c-174a7b000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184715Z-1657d5bbd48sdh4cyzadbb374800000003tg000000004s1n
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:15 UTC1362INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        134192.168.2.46029213.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:15 UTC192OUTGET /rules/rule702301v1s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:15 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:15 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1399
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT
                                                        ETag: "0x8DC582BE976026E"
                                                        x-ms-request-id: 4d8e59a4-701e-0021-64fe-163d45000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184715Z-1657d5bbd48sqtlf1huhzuwq7000000003n000000000cwev
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:15 UTC1399INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        135192.168.2.46029313.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:15 UTC192OUTGET /rules/rule703401v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:15 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:15 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1425
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT
                                                        ETag: "0x8DC582BE6BD89A1"
                                                        x-ms-request-id: c326dec7-201e-0003-0c12-17f85a000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184715Z-1657d5bbd4824mj9d6vp65b6n400000003yg0000000135cv
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:15 UTC1425INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        136192.168.2.46029413.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:15 UTC192OUTGET /rules/rule703400v0s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:15 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:15 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1388
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT
                                                        ETag: "0x8DC582BDBD9126E"
                                                        x-ms-request-id: 75ef523f-601e-000d-02f2-162618000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184715Z-1657d5bbd48cpbzgkvtewk0wu000000003v000000000yv3s
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:15 UTC1388INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        137192.168.2.46029513.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:15 UTC192OUTGET /rules/rule702501v1s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:15 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:15 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1415
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT
                                                        ETag: "0x8DC582BE7C66E85"
                                                        x-ms-request-id: 5b9c68d2-a01e-0053-7fac-188603000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184715Z-1657d5bbd48hzllksrq1r6zsvs000000014000000000bv66
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:15 UTC1415INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        138192.168.2.46029613.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:15 UTC192OUTGET /rules/rule700501v1s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:15 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:15 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1405
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT
                                                        ETag: "0x8DC582BE89A8F82"
                                                        x-ms-request-id: c9f5e5fc-201e-0071-5dfe-16ff15000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184715Z-1657d5bbd48vhs7r2p1ky7cs5w0000000490000000001zfs
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:15 UTC1405INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        139192.168.2.46029713.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:15 UTC192OUTGET /rules/rule702500v1s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:15 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:15 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1378
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT
                                                        ETag: "0x8DC582BDB813B3F"
                                                        x-ms-request-id: 87e265fd-201e-0051-4fe7-167340000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184715Z-1657d5bbd48t66tjar5xuq22r800000003v000000000fzyf
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:15 UTC1378INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        140192.168.2.46029813.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:15 UTC192OUTGET /rules/rule700500v1s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:15 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:15 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1368
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT
                                                        ETag: "0x8DC582BE51CE7B3"
                                                        x-ms-request-id: 3e7839e3-701e-0053-5cff-163a0a000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184715Z-1657d5bbd487nf59mzf5b3gk8n00000003d000000000vdsu
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:15 UTC1368INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        141192.168.2.46029913.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:15 UTC192OUTGET /rules/rule702551v1s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:15 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:15 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1415
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT
                                                        ETag: "0x8DC582BDCE9703A"
                                                        x-ms-request-id: c7b470af-b01e-005c-24fe-164c66000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184715Z-1657d5bbd48cpbzgkvtewk0wu000000003w000000000vk5t
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:15 UTC1415INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        142192.168.2.46030013.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:15 UTC192OUTGET /rules/rule702550v1s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:15 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:15 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1378
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT
                                                        ETag: "0x8DC582BE584C214"
                                                        x-ms-request-id: dfa7567c-f01e-003f-67de-16d19d000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184715Z-1657d5bbd48f7nlxc7n5fnfzh000000003gg00000000evwu
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:15 UTC1378INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        143192.168.2.46030113.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:16 UTC192OUTGET /rules/rule701351v1s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:16 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:16 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1407
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT
                                                        ETag: "0x8DC582BE687B46A"
                                                        x-ms-request-id: 20e89b60-501e-008c-3a03-17cd39000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184716Z-1657d5bbd48sdh4cyzadbb374800000003n000000000ukrd
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:16 UTC1407INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        144192.168.2.46030213.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:16 UTC192OUTGET /rules/rule701350v1s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:16 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:16 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1370
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT
                                                        ETag: "0x8DC582BDE62E0AB"
                                                        x-ms-request-id: 838d7376-001e-0014-17fe-165151000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184716Z-1657d5bbd487nf59mzf5b3gk8n00000003mg000000001s9b
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:16 UTC1370INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        145192.168.2.46030413.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:16 UTC192OUTGET /rules/rule702150v1s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:16 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:16 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1360
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT
                                                        ETag: "0x8DC582BEDC8193E"
                                                        x-ms-request-id: b1fbfe33-a01e-003d-4fd4-1698d7000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184716Z-1657d5bbd48tnj6wmberkg2xy800000003zg00000000bmt1
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:16 UTC1360INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        146192.168.2.46030313.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:16 UTC192OUTGET /rules/rule702151v1s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:16 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:16 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1397
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT
                                                        ETag: "0x8DC582BE156D2EE"
                                                        x-ms-request-id: 7d18055e-701e-0098-56ff-16395f000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184716Z-1657d5bbd487nf59mzf5b3gk8n00000003m0000000003sv4
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:16 UTC1397INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        147192.168.2.46030513.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:16 UTC192OUTGET /rules/rule703001v1s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:16 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:16 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1406
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT
                                                        ETag: "0x8DC582BEB16F27E"
                                                        x-ms-request-id: 770fdf22-501e-0035-0d02-17c923000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184716Z-1657d5bbd48tqvfc1ysmtbdrg000000003tg000000006wyk
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:16 UTC1406INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        148192.168.2.46030613.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:17 UTC192OUTGET /rules/rule703000v1s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:17 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:17 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1369
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT
                                                        ETag: "0x8DC582BE32FE1A2"
                                                        x-ms-request-id: c55b1dc3-701e-0097-42e9-16b8c1000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184717Z-1657d5bbd48cpbzgkvtewk0wu00000000420000000001c0c
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:17 UTC1369INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        149192.168.2.46030713.107.246.60443
                                                        TimestampBytes transferredDirectionData
                                                        2024-10-07 18:47:17 UTC192OUTGET /rules/rule700751v1s19.xml HTTP/1.1
                                                        Connection: Keep-Alive
                                                        Accept-Encoding: gzip
                                                        User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)
                                                        Host: otelrules.azureedge.net
                                                        2024-10-07 18:47:17 UTC563INHTTP/1.1 200 OK
                                                        Date: Mon, 07 Oct 2024 18:47:17 GMT
                                                        Content-Type: text/xml
                                                        Content-Length: 1414
                                                        Connection: close
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Vary: Accept-Encoding
                                                        Cache-Control: public, max-age=604800, immutable
                                                        Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT
                                                        ETag: "0x8DC582BE03B051D"
                                                        x-ms-request-id: 4543d13f-701e-0050-5a04-176767000000
                                                        x-ms-version: 2018-03-28
                                                        x-azure-ref: 20241007T184717Z-1657d5bbd48jwrqbupe3ktsx9w00000003y0000000014f20
                                                        x-fd-int-roxy-purgeid: 0
                                                        X-Cache: TCP_HIT
                                                        Accept-Ranges: bytes
                                                        2024-10-07 18:47:17 UTC1414INData Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e
                                                        Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan


                                                        Statistics

                                                        CPU Usage

                                                        Click to jump to process

                                                        Memory Usage

                                                        Click to jump to process

                                                        High Level Behavior Distribution

                                                        Click to dive into process behavior distribution

                                                        Behavior

                                                        Click to jump to process

                                                        System Behavior

                                                        General

                                                        Target ID:0
                                                        Start time:14:45:57
                                                        Start date:07/10/2024
                                                        Path:C:\Users\user\Desktop\file.exe
                                                        Wow64 process (32bit):true
                                                        Commandline:"C:\Users\user\Desktop\file.exe"
                                                        Imagebase:0xa80000
                                                        File size:919'040 bytes
                                                        MD5 hash:E5DEE324E4D2C335DC57F68AB1230B91
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Reputation:low
                                                        Has exited:false

                                                        General

                                                        Target ID:1
                                                        Start time:14:45:57
                                                        Start date:07/10/2024
                                                        Path:C:\Windows\SysWOW64\taskkill.exe
                                                        Wow64 process (32bit):true
                                                        Commandline:taskkill /F /IM chrome.exe /T
                                                        Imagebase:0x280000
                                                        File size:74'240 bytes
                                                        MD5 hash:CA313FD7E6C2A778FFD21CFB5C1C56CD
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Reputation:high
                                                        Has exited:true

                                                        General

                                                        Target ID:2
                                                        Start time:14:45:57
                                                        Start date:07/10/2024
                                                        Path:C:\Windows\System32\conhost.exe
                                                        Wow64 process (32bit):false
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:0x7ff7699e0000
                                                        File size:862'208 bytes
                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Reputation:high
                                                        Has exited:true

                                                        General

                                                        Target ID:3
                                                        Start time:14:45:57
                                                        Start date:07/10/2024
                                                        Path:C:\Windows\SysWOW64\taskkill.exe
                                                        Wow64 process (32bit):true
                                                        Commandline:taskkill /F /IM msedge.exe /T
                                                        Imagebase:0x280000
                                                        File size:74'240 bytes
                                                        MD5 hash:CA313FD7E6C2A778FFD21CFB5C1C56CD
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Reputation:high
                                                        Has exited:true

                                                        General

                                                        Target ID:4
                                                        Start time:14:45:57
                                                        Start date:07/10/2024
                                                        Path:C:\Windows\System32\conhost.exe
                                                        Wow64 process (32bit):false
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:0x7ff7699e0000
                                                        File size:862'208 bytes
                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Reputation:high
                                                        Has exited:true

                                                        General

                                                        Target ID:5
                                                        Start time:14:45:57
                                                        Start date:07/10/2024
                                                        Path:C:\Windows\SysWOW64\taskkill.exe
                                                        Wow64 process (32bit):true
                                                        Commandline:taskkill /F /IM firefox.exe /T
                                                        Imagebase:0x280000
                                                        File size:74'240 bytes
                                                        MD5 hash:CA313FD7E6C2A778FFD21CFB5C1C56CD
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Reputation:high
                                                        Has exited:true

                                                        General

                                                        Target ID:6
                                                        Start time:14:45:57
                                                        Start date:07/10/2024
                                                        Path:C:\Windows\System32\conhost.exe
                                                        Wow64 process (32bit):false
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:0x7ff7699e0000
                                                        File size:862'208 bytes
                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Reputation:high
                                                        Has exited:true

                                                        General

                                                        Target ID:7
                                                        Start time:14:45:57
                                                        Start date:07/10/2024
                                                        Path:C:\Windows\SysWOW64\taskkill.exe
                                                        Wow64 process (32bit):true
                                                        Commandline:taskkill /F /IM opera.exe /T
                                                        Imagebase:0x280000
                                                        File size:74'240 bytes
                                                        MD5 hash:CA313FD7E6C2A778FFD21CFB5C1C56CD
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Reputation:high
                                                        Has exited:true

                                                        General

                                                        Target ID:8
                                                        Start time:14:45:57
                                                        Start date:07/10/2024
                                                        Path:C:\Windows\System32\conhost.exe
                                                        Wow64 process (32bit):false
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:0x7ff7699e0000
                                                        File size:862'208 bytes
                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Reputation:high
                                                        Has exited:true

                                                        General

                                                        Target ID:9
                                                        Start time:14:45:58
                                                        Start date:07/10/2024
                                                        Path:C:\Windows\SysWOW64\taskkill.exe
                                                        Wow64 process (32bit):true
                                                        Commandline:taskkill /F /IM brave.exe /T
                                                        Imagebase:0x280000
                                                        File size:74'240 bytes
                                                        MD5 hash:CA313FD7E6C2A778FFD21CFB5C1C56CD
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Reputation:high
                                                        Has exited:true

                                                        General

                                                        Target ID:10
                                                        Start time:14:45:58
                                                        Start date:07/10/2024
                                                        Path:C:\Windows\System32\conhost.exe
                                                        Wow64 process (32bit):false
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:0x7ff7699e0000
                                                        File size:862'208 bytes
                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Reputation:high
                                                        Has exited:true

                                                        General

                                                        Target ID:11
                                                        Start time:14:45:59
                                                        Start date:07/10/2024
                                                        Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        Wow64 process (32bit):false
                                                        Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars
                                                        Imagebase:0x7ff76e190000
                                                        File size:3'242'272 bytes
                                                        MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Reputation:high
                                                        Has exited:false

                                                        General

                                                        Target ID:13
                                                        Start time:14:45:59
                                                        Start date:07/10/2024
                                                        Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        Wow64 process (32bit):false
                                                        Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=2008,i,16001963965146608376,17466102332235184443,262144 /prefetch:8
                                                        Imagebase:0x7ff76e190000
                                                        File size:3'242'272 bytes
                                                        MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Reputation:high
                                                        Has exited:false

                                                        General

                                                        Target ID:14
                                                        Start time:14:46:10
                                                        Start date:07/10/2024
                                                        Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        Wow64 process (32bit):false
                                                        Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5356 --field-trial-handle=2008,i,16001963965146608376,17466102332235184443,262144 /prefetch:8
                                                        Imagebase:0x7ff76e190000
                                                        File size:3'242'272 bytes
                                                        MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                        Has elevated privileges:false
                                                        Has administrator privileges:false
                                                        Programmed in:C, C++ or other language
                                                        Has exited:false

                                                        General

                                                        Target ID:15
                                                        Start time:14:46:10
                                                        Start date:07/10/2024
                                                        Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        Wow64 process (32bit):false
                                                        Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 --field-trial-handle=2008,i,16001963965146608376,17466102332235184443,262144 /prefetch:8
                                                        Imagebase:0x7ff76e190000
                                                        File size:3'242'272 bytes
                                                        MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Has exited:true

                                                        Disassembly

                                                        Reset < >

                                                          Execution Graph

                                                          Execution Coverage:2.1%
                                                          Dynamic/Decrypted Code Coverage:0%
                                                          Signature Coverage:4.6%
                                                          Total number of Nodes:1607
                                                          Total number of Limit Nodes:52
                                                          execution_graph 95092 b12a55 95100 af1ebc 95092->95100 95095 b12a87 95096 b12a70 95102 ae39c0 22 API calls 95096->95102 95098 b12a7c 95103 ae417d 22 API calls __fread_nolock 95098->95103 95101 af1ec3 IsWindow 95100->95101 95101->95095 95101->95096 95102->95098 95103->95095 95104 a81cad SystemParametersInfoW 95105 ab8402 95110 ab81be 95105->95110 95109 ab842a 95115 ab81ef try_get_first_available_module 95110->95115 95112 ab83ee 95129 ab27ec 26 API calls __cftof 95112->95129 95114 ab8343 95114->95109 95122 ac0984 95114->95122 95118 ab8338 95115->95118 95125 aa8e0b 40 API calls 2 library calls 95115->95125 95117 ab838c 95117->95118 95126 aa8e0b 40 API calls 2 library calls 95117->95126 95118->95114 95128 aaf2d9 20 API calls __dosmaperr 95118->95128 95120 ab83ab 95120->95118 95127 aa8e0b 40 API calls 2 library calls 95120->95127 95130 ac0081 95122->95130 95124 ac099f 95124->95109 95125->95117 95126->95120 95127->95118 95128->95112 95129->95114 95131 ac008d ___scrt_is_nonwritable_in_current_image 95130->95131 95132 ac009b 95131->95132 95135 ac00d4 95131->95135 95187 aaf2d9 20 API calls __dosmaperr 95132->95187 95134 ac00a0 95188 ab27ec 26 API calls __cftof 95134->95188 95141 ac065b 95135->95141 95140 ac00aa __fread_nolock 95140->95124 95142 ac0678 95141->95142 95143 ac068d 95142->95143 95144 ac06a6 95142->95144 95204 aaf2c6 20 API calls __dosmaperr 95143->95204 95190 ab5221 95144->95190 95147 ac0692 95205 aaf2d9 20 API calls __dosmaperr 95147->95205 95148 ac06ab 95149 ac06cb 95148->95149 95150 ac06b4 95148->95150 95203 ac039a CreateFileW 95149->95203 95206 aaf2c6 20 API calls __dosmaperr 95150->95206 95154 ac00f8 95189 ac0121 LeaveCriticalSection __wsopen_s 95154->95189 95155 ac06b9 95207 aaf2d9 20 API calls __dosmaperr 95155->95207 95156 ac0781 GetFileType 95159 ac078c GetLastError 95156->95159 95160 ac07d3 95156->95160 95158 ac0756 GetLastError 95209 aaf2a3 20 API calls __dosmaperr 95158->95209 95210 aaf2a3 20 API calls __dosmaperr 95159->95210 95212 ab516a 21 API calls 2 library calls 95160->95212 95161 ac0704 95161->95156 95161->95158 95208 ac039a CreateFileW 95161->95208 95165 ac079a CloseHandle 95165->95147 95168 ac07c3 95165->95168 95167 ac0749 95167->95156 95167->95158 95211 aaf2d9 20 API calls __dosmaperr 95168->95211 95169 ac07f4 95171 ac0840 95169->95171 95213 ac05ab 72 API calls 3 library calls 95169->95213 95176 ac086d 95171->95176 95214 ac014d 72 API calls 4 library calls 95171->95214 95172 ac07c8 95172->95147 95175 ac0866 95175->95176 95177 ac087e 95175->95177 95215 ab86ae 95176->95215 95177->95154 95179 ac08fc CloseHandle 95177->95179 95230 ac039a CreateFileW 95179->95230 95181 ac0927 95182 ac0931 GetLastError 95181->95182 95183 ac095d 95181->95183 95231 aaf2a3 20 API calls __dosmaperr 95182->95231 95183->95154 95185 ac093d 95232 ab5333 21 API calls 2 library calls 95185->95232 95187->95134 95188->95140 95189->95140 95191 ab522d ___scrt_is_nonwritable_in_current_image 95190->95191 95233 ab2f5e EnterCriticalSection 95191->95233 95193 ab527b 95234 ab532a 95193->95234 95194 ab5259 95237 ab5000 21 API calls 3 library calls 95194->95237 95195 ab5234 95195->95193 95195->95194 95200 ab52c7 EnterCriticalSection 95195->95200 95198 ab52a4 __fread_nolock 95198->95148 95199 ab525e 95199->95193 95238 ab5147 EnterCriticalSection 95199->95238 95200->95193 95201 ab52d4 LeaveCriticalSection 95200->95201 95201->95195 95203->95161 95204->95147 95205->95154 95206->95155 95207->95147 95208->95167 95209->95147 95210->95165 95211->95172 95212->95169 95213->95171 95214->95175 95240 ab53c4 95215->95240 95217 ab86be 95218 ab86c4 95217->95218 95220 ab86f6 95217->95220 95222 ab53c4 __wsopen_s 26 API calls 95217->95222 95253 ab5333 21 API calls 2 library calls 95218->95253 95220->95218 95223 ab53c4 __wsopen_s 26 API calls 95220->95223 95221 ab871c 95224 ab873e 95221->95224 95254 aaf2a3 20 API calls __dosmaperr 95221->95254 95225 ab86ed 95222->95225 95226 ab8702 CloseHandle 95223->95226 95224->95154 95228 ab53c4 __wsopen_s 26 API calls 95225->95228 95226->95218 95229 ab870e GetLastError 95226->95229 95228->95220 95229->95218 95230->95181 95231->95185 95232->95183 95233->95195 95239 ab2fa6 LeaveCriticalSection 95234->95239 95236 ab5331 95236->95198 95237->95199 95238->95193 95239->95236 95241 ab53d1 95240->95241 95242 ab53e6 95240->95242 95255 aaf2c6 20 API calls __dosmaperr 95241->95255 95247 ab540b 95242->95247 95257 aaf2c6 20 API calls __dosmaperr 95242->95257 95244 ab53d6 95256 aaf2d9 20 API calls __dosmaperr 95244->95256 95247->95217 95248 ab5416 95258 aaf2d9 20 API calls __dosmaperr 95248->95258 95249 ab53de 95249->95217 95251 ab541e 95259 ab27ec 26 API calls __cftof 95251->95259 95253->95221 95254->95224 95255->95244 95256->95249 95257->95248 95258->95251 95259->95249 95260 ac2ba5 95261 ac2baf 95260->95261 95262 a82b25 95260->95262 95306 a83a5a 95261->95306 95288 a82b83 7 API calls 95262->95288 95266 ac2bb8 95313 a89cb3 95266->95313 95269 a82b2f 95276 a82b44 95269->95276 95292 a83837 95269->95292 95270 ac2bc6 95271 ac2bce 95270->95271 95272 ac2bf5 95270->95272 95319 a833c6 95271->95319 95273 a833c6 22 API calls 95272->95273 95287 ac2bf1 GetForegroundWindow ShellExecuteW 95273->95287 95279 a82b5f 95276->95279 95302 a830f2 95276->95302 95284 a82b66 SetCurrentDirectoryW 95279->95284 95281 ac2c26 95281->95279 95286 a82b7a 95284->95286 95285 a833c6 22 API calls 95285->95287 95287->95281 95337 a82cd4 7 API calls 95288->95337 95290 a82b2a 95291 a82c63 CreateWindowExW CreateWindowExW ShowWindow ShowWindow 95290->95291 95291->95269 95293 a83862 ___scrt_fastfail 95292->95293 95338 a84212 95293->95338 95296 a838e8 95298 ac3386 Shell_NotifyIconW 95296->95298 95299 a83906 Shell_NotifyIconW 95296->95299 95342 a83923 95299->95342 95301 a8391c 95301->95276 95303 a83154 95302->95303 95304 a83104 ___scrt_fastfail 95302->95304 95303->95279 95305 a83123 Shell_NotifyIconW 95304->95305 95305->95303 95429 ac1f50 95306->95429 95309 a89cb3 22 API calls 95310 a83a8d 95309->95310 95431 a83aa2 95310->95431 95312 a83a97 95312->95266 95314 a89cc2 _wcslen 95313->95314 95315 a9fe0b 22 API calls 95314->95315 95316 a89cea __fread_nolock 95315->95316 95317 a9fddb 22 API calls 95316->95317 95318 a89d00 95317->95318 95318->95270 95320 a833dd 95319->95320 95321 ac30bb 95319->95321 95451 a833ee 95320->95451 95322 a9fddb 22 API calls 95321->95322 95325 ac30c5 _wcslen 95322->95325 95324 a833e8 95328 a86350 95324->95328 95326 a9fe0b 22 API calls 95325->95326 95327 ac30fe __fread_nolock 95326->95327 95329 a86362 95328->95329 95330 ac4a51 95328->95330 95466 a86373 95329->95466 95476 a84a88 22 API calls __fread_nolock 95330->95476 95333 a8636e 95333->95285 95334 ac4a5b 95335 ac4a67 95334->95335 95477 a8a8c7 22 API calls __fread_nolock 95334->95477 95337->95290 95339 ac35a4 95338->95339 95340 a838b7 95338->95340 95339->95340 95341 ac35ad DestroyIcon 95339->95341 95340->95296 95364 aec874 42 API calls _strftime 95340->95364 95341->95340 95343 a8393f 95342->95343 95344 a83a13 95342->95344 95365 a86270 95343->95365 95344->95301 95347 a8395a 95370 a86b57 95347->95370 95348 ac3393 LoadStringW 95350 ac33ad 95348->95350 95358 a83994 ___scrt_fastfail 95350->95358 95382 a8a8c7 22 API calls __fread_nolock 95350->95382 95351 a8396f 95352 a8397c 95351->95352 95353 ac33c9 95351->95353 95352->95350 95355 a83986 95352->95355 95356 a86350 22 API calls 95353->95356 95357 a86350 22 API calls 95355->95357 95359 ac33d7 95356->95359 95357->95358 95361 a839f9 Shell_NotifyIconW 95358->95361 95359->95358 95360 a833c6 22 API calls 95359->95360 95362 ac33f9 95360->95362 95361->95344 95363 a833c6 22 API calls 95362->95363 95363->95358 95364->95296 95383 a9fe0b 95365->95383 95367 a86295 95393 a9fddb 95367->95393 95369 a8394d 95369->95347 95369->95348 95371 ac4ba1 95370->95371 95373 a86b67 _wcslen 95370->95373 95419 a893b2 95371->95419 95375 a86b7d 95373->95375 95376 a86ba2 95373->95376 95374 ac4baa 95374->95374 95418 a86f34 22 API calls 95375->95418 95378 a9fddb 22 API calls 95376->95378 95380 a86bae 95378->95380 95379 a86b85 __fread_nolock 95379->95351 95381 a9fe0b 22 API calls 95380->95381 95381->95379 95382->95358 95385 a9fddb 95383->95385 95386 a9fdfa 95385->95386 95389 a9fdfc 95385->95389 95403 aaea0c 95385->95403 95410 aa4ead 7 API calls 2 library calls 95385->95410 95386->95367 95388 aa066d 95412 aa32a4 RaiseException 95388->95412 95389->95388 95411 aa32a4 RaiseException 95389->95411 95392 aa068a 95392->95367 95396 a9fde0 95393->95396 95394 aaea0c ___std_exception_copy 21 API calls 95394->95396 95395 a9fdfa 95395->95369 95396->95394 95396->95395 95399 a9fdfc 95396->95399 95415 aa4ead 7 API calls 2 library calls 95396->95415 95398 aa066d 95417 aa32a4 RaiseException 95398->95417 95399->95398 95416 aa32a4 RaiseException 95399->95416 95402 aa068a 95402->95369 95405 ab3820 FindHandler 95403->95405 95404 ab385e 95414 aaf2d9 20 API calls __dosmaperr 95404->95414 95405->95404 95406 ab3849 RtlAllocateHeap 95405->95406 95413 aa4ead 7 API calls 2 library calls 95405->95413 95406->95405 95408 ab385c 95406->95408 95408->95385 95410->95385 95411->95388 95412->95392 95413->95405 95414->95408 95415->95396 95416->95398 95417->95402 95418->95379 95420 a893c0 95419->95420 95421 a893c9 __fread_nolock 95419->95421 95420->95421 95423 a8aec9 95420->95423 95421->95374 95421->95421 95424 a8aedc 95423->95424 95428 a8aed9 __fread_nolock 95423->95428 95425 a9fddb 22 API calls 95424->95425 95426 a8aee7 95425->95426 95427 a9fe0b 22 API calls 95426->95427 95427->95428 95428->95421 95430 a83a67 GetModuleFileNameW 95429->95430 95430->95309 95432 ac1f50 __wsopen_s 95431->95432 95433 a83aaf GetFullPathNameW 95432->95433 95434 a83ae9 95433->95434 95435 a83ace 95433->95435 95445 a8a6c3 95434->95445 95436 a86b57 22 API calls 95435->95436 95438 a83ada 95436->95438 95441 a837a0 95438->95441 95442 a837ae 95441->95442 95443 a893b2 22 API calls 95442->95443 95444 a837c2 95443->95444 95444->95312 95446 a8a6dd 95445->95446 95450 a8a6d0 95445->95450 95447 a9fddb 22 API calls 95446->95447 95448 a8a6e7 95447->95448 95449 a9fe0b 22 API calls 95448->95449 95449->95450 95450->95438 95452 a833fe _wcslen 95451->95452 95453 ac311d 95452->95453 95454 a83411 95452->95454 95456 a9fddb 22 API calls 95453->95456 95461 a8a587 95454->95461 95458 ac3127 95456->95458 95457 a8341e __fread_nolock 95457->95324 95459 a9fe0b 22 API calls 95458->95459 95460 ac3157 __fread_nolock 95459->95460 95462 a8a59d 95461->95462 95465 a8a598 __fread_nolock 95461->95465 95463 a9fe0b 22 API calls 95462->95463 95464 acf80f 95462->95464 95463->95465 95464->95464 95465->95457 95467 a863b6 __fread_nolock 95466->95467 95468 a86382 95466->95468 95467->95333 95468->95467 95469 ac4a82 95468->95469 95470 a863a9 95468->95470 95471 a9fddb 22 API calls 95469->95471 95472 a8a587 22 API calls 95470->95472 95473 ac4a91 95471->95473 95472->95467 95474 a9fe0b 22 API calls 95473->95474 95475 ac4ac5 __fread_nolock 95474->95475 95476->95334 95477->95335 95478 a82de3 95479 a82df0 __wsopen_s 95478->95479 95480 a82e09 95479->95480 95481 ac2c2b ___scrt_fastfail 95479->95481 95482 a83aa2 23 API calls 95480->95482 95484 ac2c47 GetOpenFileNameW 95481->95484 95483 a82e12 95482->95483 95494 a82da5 95483->95494 95486 ac2c96 95484->95486 95488 a86b57 22 API calls 95486->95488 95490 ac2cab 95488->95490 95490->95490 95491 a82e27 95512 a844a8 95491->95512 95495 ac1f50 __wsopen_s 95494->95495 95496 a82db2 GetLongPathNameW 95495->95496 95497 a86b57 22 API calls 95496->95497 95498 a82dda 95497->95498 95499 a83598 95498->95499 95541 a8a961 95499->95541 95502 a83aa2 23 API calls 95503 a835b5 95502->95503 95504 a835c0 95503->95504 95508 ac32eb 95503->95508 95546 a8515f 95504->95546 95510 ac330d 95508->95510 95558 a9ce60 41 API calls 95508->95558 95511 a835df 95511->95491 95559 a84ecb 95512->95559 95515 ac3833 95581 af2cf9 95515->95581 95516 a84ecb 94 API calls 95518 a844e1 95516->95518 95518->95515 95520 a844e9 95518->95520 95519 ac3848 95521 ac384c 95519->95521 95522 ac3869 95519->95522 95524 ac3854 95520->95524 95525 a844f5 95520->95525 95608 a84f39 95521->95608 95523 a9fe0b 22 API calls 95522->95523 95532 ac38ae 95523->95532 95614 aeda5a 82 API calls 95524->95614 95607 a8940c 136 API calls 2 library calls 95525->95607 95529 a82e31 95530 ac3862 95530->95522 95531 a84f39 68 API calls 95535 ac3a5f 95531->95535 95532->95535 95538 a89cb3 22 API calls 95532->95538 95615 ae967e 22 API calls __fread_nolock 95532->95615 95616 ae95ad 42 API calls _wcslen 95532->95616 95617 af0b5a 22 API calls 95532->95617 95618 a8a4a1 22 API calls __fread_nolock 95532->95618 95619 a83ff7 22 API calls 95532->95619 95535->95531 95620 ae989b 82 API calls __wsopen_s 95535->95620 95538->95532 95542 a9fe0b 22 API calls 95541->95542 95543 a8a976 95542->95543 95544 a9fddb 22 API calls 95543->95544 95545 a835aa 95544->95545 95545->95502 95547 a8516e 95546->95547 95551 a8518f __fread_nolock 95546->95551 95549 a9fe0b 22 API calls 95547->95549 95548 a9fddb 22 API calls 95550 a835cc 95548->95550 95549->95551 95552 a835f3 95550->95552 95551->95548 95553 a83605 95552->95553 95557 a83624 __fread_nolock 95552->95557 95555 a9fe0b 22 API calls 95553->95555 95554 a9fddb 22 API calls 95556 a8363b 95554->95556 95555->95557 95556->95511 95557->95554 95558->95508 95621 a84e90 LoadLibraryA 95559->95621 95564 ac3ccf 95566 a84f39 68 API calls 95564->95566 95565 a84ef6 LoadLibraryExW 95629 a84e59 LoadLibraryA 95565->95629 95568 ac3cd6 95566->95568 95570 a84e59 3 API calls 95568->95570 95572 ac3cde 95570->95572 95651 a850f5 95572->95651 95573 a84f20 95573->95572 95574 a84f2c 95573->95574 95576 a84f39 68 API calls 95574->95576 95578 a844cd 95576->95578 95578->95515 95578->95516 95580 ac3d05 95582 af2d15 95581->95582 95583 a8511f 64 API calls 95582->95583 95584 af2d29 95583->95584 95794 af2e66 95584->95794 95587 af2d3f 95587->95519 95588 a850f5 40 API calls 95589 af2d56 95588->95589 95590 a850f5 40 API calls 95589->95590 95591 af2d66 95590->95591 95592 a850f5 40 API calls 95591->95592 95593 af2d81 95592->95593 95594 a850f5 40 API calls 95593->95594 95595 af2d9c 95594->95595 95596 a8511f 64 API calls 95595->95596 95597 af2db3 95596->95597 95598 aaea0c ___std_exception_copy 21 API calls 95597->95598 95599 af2dba 95598->95599 95600 aaea0c ___std_exception_copy 21 API calls 95599->95600 95601 af2dc4 95600->95601 95602 a850f5 40 API calls 95601->95602 95603 af2dd8 95602->95603 95604 af28fe 27 API calls 95603->95604 95605 af2dee 95604->95605 95605->95587 95800 af22ce 79 API calls 95605->95800 95607->95529 95609 a84f43 95608->95609 95611 a84f4a 95608->95611 95801 aae678 95609->95801 95612 a84f59 95611->95612 95613 a84f6a FreeLibrary 95611->95613 95612->95524 95613->95612 95614->95530 95615->95532 95616->95532 95617->95532 95618->95532 95619->95532 95620->95535 95622 a84ea8 GetProcAddress 95621->95622 95623 a84ec6 95621->95623 95624 a84eb8 95622->95624 95626 aae5eb 95623->95626 95624->95623 95625 a84ebf FreeLibrary 95624->95625 95625->95623 95659 aae52a 95626->95659 95628 a84eea 95628->95564 95628->95565 95630 a84e8d 95629->95630 95631 a84e6e GetProcAddress 95629->95631 95634 a84f80 95630->95634 95632 a84e7e 95631->95632 95632->95630 95633 a84e86 FreeLibrary 95632->95633 95633->95630 95635 a9fe0b 22 API calls 95634->95635 95636 a84f95 95635->95636 95720 a85722 95636->95720 95638 a84fa1 __fread_nolock 95639 ac3d1d 95638->95639 95640 a850a5 95638->95640 95650 a84fdc 95638->95650 95734 af304d 74 API calls 95639->95734 95723 a842a2 CreateStreamOnHGlobal 95640->95723 95643 ac3d22 95645 a8511f 64 API calls 95643->95645 95644 a850f5 40 API calls 95644->95650 95646 ac3d45 95645->95646 95647 a850f5 40 API calls 95646->95647 95648 a8506e messages 95647->95648 95648->95573 95650->95643 95650->95644 95650->95648 95729 a8511f 95650->95729 95652 ac3d70 95651->95652 95653 a85107 95651->95653 95756 aae8c4 95653->95756 95656 af28fe 95777 af274e 95656->95777 95658 af2919 95658->95580 95661 aae536 ___scrt_is_nonwritable_in_current_image 95659->95661 95660 aae544 95684 aaf2d9 20 API calls __dosmaperr 95660->95684 95661->95660 95664 aae574 95661->95664 95663 aae549 95685 ab27ec 26 API calls __cftof 95663->95685 95666 aae579 95664->95666 95667 aae586 95664->95667 95686 aaf2d9 20 API calls __dosmaperr 95666->95686 95676 ab8061 95667->95676 95670 aae58f 95671 aae5a2 95670->95671 95672 aae595 95670->95672 95688 aae5d4 LeaveCriticalSection __fread_nolock 95671->95688 95687 aaf2d9 20 API calls __dosmaperr 95672->95687 95673 aae554 __fread_nolock 95673->95628 95677 ab806d ___scrt_is_nonwritable_in_current_image 95676->95677 95689 ab2f5e EnterCriticalSection 95677->95689 95679 ab807b 95690 ab80fb 95679->95690 95683 ab80ac __fread_nolock 95683->95670 95684->95663 95685->95673 95686->95673 95687->95673 95688->95673 95689->95679 95697 ab811e 95690->95697 95691 ab8088 95704 ab80b7 95691->95704 95692 ab8177 95709 ab4c7d 20 API calls 2 library calls 95692->95709 95694 ab8180 95710 ab29c8 95694->95710 95697->95691 95697->95692 95707 aa918d EnterCriticalSection 95697->95707 95708 aa91a1 LeaveCriticalSection 95697->95708 95698 ab8189 95698->95691 95716 ab3405 11 API calls 2 library calls 95698->95716 95700 ab81a8 95717 aa918d EnterCriticalSection 95700->95717 95703 ab81bb 95703->95691 95719 ab2fa6 LeaveCriticalSection 95704->95719 95706 ab80be 95706->95683 95707->95697 95708->95697 95709->95694 95711 ab29d3 RtlFreeHeap 95710->95711 95712 ab29fc __dosmaperr 95710->95712 95711->95712 95713 ab29e8 95711->95713 95712->95698 95718 aaf2d9 20 API calls __dosmaperr 95713->95718 95715 ab29ee GetLastError 95715->95712 95716->95700 95717->95703 95718->95715 95719->95706 95721 a9fddb 22 API calls 95720->95721 95722 a85734 95721->95722 95722->95638 95724 a842bc FindResourceExW 95723->95724 95725 a842d9 95723->95725 95724->95725 95726 ac35ba LoadResource 95724->95726 95725->95650 95726->95725 95727 ac35cf SizeofResource 95726->95727 95727->95725 95728 ac35e3 LockResource 95727->95728 95728->95725 95730 a8512e 95729->95730 95731 ac3d90 95729->95731 95735 aaece3 95730->95735 95734->95643 95738 aaeaaa 95735->95738 95737 a8513c 95737->95650 95742 aaeab6 ___scrt_is_nonwritable_in_current_image 95738->95742 95739 aaeac2 95751 aaf2d9 20 API calls __dosmaperr 95739->95751 95741 aaeae8 95753 aa918d EnterCriticalSection 95741->95753 95742->95739 95742->95741 95743 aaeac7 95752 ab27ec 26 API calls __cftof 95743->95752 95746 aaeaf4 95754 aaec0a 62 API calls 2 library calls 95746->95754 95748 aaeb08 95755 aaeb27 LeaveCriticalSection __fread_nolock 95748->95755 95750 aaead2 __fread_nolock 95750->95737 95751->95743 95752->95750 95753->95746 95754->95748 95755->95750 95759 aae8e1 95756->95759 95758 a85118 95758->95656 95760 aae8ed ___scrt_is_nonwritable_in_current_image 95759->95760 95761 aae92d 95760->95761 95762 aae925 __fread_nolock 95760->95762 95767 aae900 ___scrt_fastfail 95760->95767 95774 aa918d EnterCriticalSection 95761->95774 95762->95758 95764 aae937 95775 aae6f8 38 API calls 4 library calls 95764->95775 95772 aaf2d9 20 API calls __dosmaperr 95767->95772 95768 aae91a 95773 ab27ec 26 API calls __cftof 95768->95773 95769 aae94e 95776 aae96c LeaveCriticalSection __fread_nolock 95769->95776 95772->95768 95773->95762 95774->95764 95775->95769 95776->95762 95780 aae4e8 95777->95780 95779 af275d 95779->95658 95783 aae469 95780->95783 95782 aae505 95782->95779 95784 aae478 95783->95784 95785 aae48c 95783->95785 95791 aaf2d9 20 API calls __dosmaperr 95784->95791 95790 aae488 __alldvrm 95785->95790 95793 ab333f 11 API calls 2 library calls 95785->95793 95788 aae47d 95792 ab27ec 26 API calls __cftof 95788->95792 95790->95782 95791->95788 95792->95790 95793->95790 95798 af2e7a 95794->95798 95795 af2d3b 95795->95587 95795->95588 95796 a850f5 40 API calls 95796->95798 95797 af28fe 27 API calls 95797->95798 95798->95795 95798->95796 95798->95797 95799 a8511f 64 API calls 95798->95799 95799->95798 95800->95587 95802 aae684 ___scrt_is_nonwritable_in_current_image 95801->95802 95803 aae695 95802->95803 95805 aae6aa 95802->95805 95814 aaf2d9 20 API calls __dosmaperr 95803->95814 95813 aae6a5 __fread_nolock 95805->95813 95816 aa918d EnterCriticalSection 95805->95816 95807 aae69a 95815 ab27ec 26 API calls __cftof 95807->95815 95808 aae6c6 95817 aae602 95808->95817 95811 aae6d1 95833 aae6ee LeaveCriticalSection __fread_nolock 95811->95833 95813->95611 95814->95807 95815->95813 95816->95808 95818 aae60f 95817->95818 95819 aae624 95817->95819 95834 aaf2d9 20 API calls __dosmaperr 95818->95834 95825 aae61f 95819->95825 95836 aadc0b 95819->95836 95821 aae614 95835 ab27ec 26 API calls __cftof 95821->95835 95825->95811 95829 aae646 95853 ab862f 95829->95853 95832 ab29c8 _free 20 API calls 95832->95825 95833->95813 95834->95821 95835->95825 95837 aadc23 95836->95837 95841 aadc1f 95836->95841 95838 aad955 __fread_nolock 26 API calls 95837->95838 95837->95841 95839 aadc43 95838->95839 95868 ab59be 62 API calls 5 library calls 95839->95868 95842 ab4d7a 95841->95842 95843 ab4d90 95842->95843 95844 aae640 95842->95844 95843->95844 95845 ab29c8 _free 20 API calls 95843->95845 95846 aad955 95844->95846 95845->95844 95847 aad961 95846->95847 95848 aad976 95846->95848 95869 aaf2d9 20 API calls __dosmaperr 95847->95869 95848->95829 95850 aad966 95870 ab27ec 26 API calls __cftof 95850->95870 95852 aad971 95852->95829 95854 ab863e 95853->95854 95855 ab8653 95853->95855 95871 aaf2c6 20 API calls __dosmaperr 95854->95871 95857 ab868e 95855->95857 95861 ab867a 95855->95861 95876 aaf2c6 20 API calls __dosmaperr 95857->95876 95858 ab8643 95872 aaf2d9 20 API calls __dosmaperr 95858->95872 95873 ab8607 95861->95873 95862 ab8693 95877 aaf2d9 20 API calls __dosmaperr 95862->95877 95865 ab869b 95878 ab27ec 26 API calls __cftof 95865->95878 95866 aae64c 95866->95825 95866->95832 95868->95841 95869->95850 95870->95852 95871->95858 95872->95866 95879 ab8585 95873->95879 95875 ab862b 95875->95866 95876->95862 95877->95865 95878->95866 95880 ab8591 ___scrt_is_nonwritable_in_current_image 95879->95880 95890 ab5147 EnterCriticalSection 95880->95890 95882 ab859f 95883 ab85d1 95882->95883 95884 ab85c6 95882->95884 95891 aaf2d9 20 API calls __dosmaperr 95883->95891 95885 ab86ae __wsopen_s 29 API calls 95884->95885 95887 ab85cc 95885->95887 95892 ab85fb LeaveCriticalSection __wsopen_s 95887->95892 95889 ab85ee __fread_nolock 95889->95875 95890->95882 95891->95887 95892->95889 95893 a81044 95898 a810f3 95893->95898 95895 a8104a 95934 aa00a3 29 API calls __onexit 95895->95934 95897 a81054 95935 a81398 95898->95935 95902 a8116a 95903 a8a961 22 API calls 95902->95903 95904 a81174 95903->95904 95905 a8a961 22 API calls 95904->95905 95906 a8117e 95905->95906 95907 a8a961 22 API calls 95906->95907 95908 a81188 95907->95908 95909 a8a961 22 API calls 95908->95909 95910 a811c6 95909->95910 95911 a8a961 22 API calls 95910->95911 95912 a81292 95911->95912 95945 a8171c 95912->95945 95916 a812c4 95917 a8a961 22 API calls 95916->95917 95918 a812ce 95917->95918 95966 a91940 95918->95966 95920 a812f9 95976 a81aab 95920->95976 95922 a81315 95923 a81325 GetStdHandle 95922->95923 95924 a8137a 95923->95924 95925 ac2485 95923->95925 95928 a81387 OleInitialize 95924->95928 95925->95924 95926 ac248e 95925->95926 95927 a9fddb 22 API calls 95926->95927 95929 ac2495 95927->95929 95928->95895 95983 af011d InitializeCriticalSectionAndSpinCount InterlockedExchange GetCurrentProcess GetCurrentProcess DuplicateHandle 95929->95983 95931 ac249e 95984 af0944 CreateThread 95931->95984 95933 ac24aa CloseHandle 95933->95924 95934->95897 95985 a813f1 95935->95985 95938 a813f1 22 API calls 95939 a813d0 95938->95939 95940 a8a961 22 API calls 95939->95940 95941 a813dc 95940->95941 95942 a86b57 22 API calls 95941->95942 95943 a81129 95942->95943 95944 a81bc3 6 API calls 95943->95944 95944->95902 95946 a8a961 22 API calls 95945->95946 95947 a8172c 95946->95947 95948 a8a961 22 API calls 95947->95948 95949 a81734 95948->95949 95950 a8a961 22 API calls 95949->95950 95951 a8174f 95950->95951 95952 a9fddb 22 API calls 95951->95952 95953 a8129c 95952->95953 95954 a81b4a 95953->95954 95955 a81b58 95954->95955 95956 a8a961 22 API calls 95955->95956 95957 a81b63 95956->95957 95958 a8a961 22 API calls 95957->95958 95959 a81b6e 95958->95959 95960 a8a961 22 API calls 95959->95960 95961 a81b79 95960->95961 95962 a8a961 22 API calls 95961->95962 95963 a81b84 95962->95963 95964 a9fddb 22 API calls 95963->95964 95965 a81b96 RegisterWindowMessageW 95964->95965 95965->95916 95967 a91981 95966->95967 95968 a9195d 95966->95968 95992 aa0242 5 API calls __Init_thread_wait 95967->95992 95969 a9196e 95968->95969 95994 aa0242 5 API calls __Init_thread_wait 95968->95994 95969->95920 95971 a9198b 95971->95968 95993 aa01f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 95971->95993 95973 a98727 95973->95969 95995 aa01f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 95973->95995 95977 ac272d 95976->95977 95978 a81abb 95976->95978 95996 af3209 23 API calls 95977->95996 95979 a9fddb 22 API calls 95978->95979 95981 a81ac3 95979->95981 95981->95922 95982 ac2738 95983->95931 95984->95933 95997 af092a 28 API calls 95984->95997 95986 a8a961 22 API calls 95985->95986 95987 a813fc 95986->95987 95988 a8a961 22 API calls 95987->95988 95989 a81404 95988->95989 95990 a8a961 22 API calls 95989->95990 95991 a813c6 95990->95991 95991->95938 95992->95971 95993->95968 95994->95973 95995->95969 95996->95982 95998 ad2a00 96014 a8d7b0 messages 95998->96014 95999 a8db11 PeekMessageW 95999->96014 96000 a8d807 GetInputState 96000->95999 96000->96014 96002 ad1cbe TranslateAcceleratorW 96002->96014 96003 a8da04 timeGetTime 96003->96014 96004 a8db8f PeekMessageW 96004->96014 96005 a8db73 TranslateMessage DispatchMessageW 96005->96004 96006 a8dbaf Sleep 96006->96014 96007 ad2b74 Sleep 96020 ad2ae5 96007->96020 96010 ad1dda timeGetTime 96158 a9e300 23 API calls 96010->96158 96013 ad2c0b GetExitCodeProcess 96017 ad2c37 CloseHandle 96013->96017 96018 ad2c21 WaitForSingleObject 96013->96018 96014->95999 96014->96000 96014->96002 96014->96003 96014->96004 96014->96005 96014->96006 96014->96007 96014->96010 96015 b129bf GetForegroundWindow 96014->96015 96019 a8d9d5 96014->96019 96014->96020 96030 a8dd50 96014->96030 96037 a91310 96014->96037 96093 a8bf40 96014->96093 96151 a9edf6 96014->96151 96156 a8dfd0 349 API calls 3 library calls 96014->96156 96157 a9e551 timeGetTime 96014->96157 96159 af3a2a 23 API calls 96014->96159 96160 a8ec40 96014->96160 96184 af359c 82 API calls __wsopen_s 96014->96184 96015->96014 96017->96020 96018->96014 96018->96017 96020->96013 96020->96014 96020->96019 96021 ad2ca9 Sleep 96020->96021 96185 b05658 23 API calls 96020->96185 96186 aee97b QueryPerformanceCounter QueryPerformanceFrequency Sleep QueryPerformanceCounter Sleep 96020->96186 96187 a9e551 timeGetTime 96020->96187 96188 aed4dc 47 API calls 96020->96188 96021->96014 96031 a8dd6f 96030->96031 96032 a8dd83 96030->96032 96189 a8d260 96031->96189 96221 af359c 82 API calls __wsopen_s 96032->96221 96034 a8dd7a 96034->96014 96036 ad2f75 96036->96036 96038 a917b0 96037->96038 96039 a91376 96037->96039 96277 aa0242 5 API calls __Init_thread_wait 96038->96277 96041 a91390 96039->96041 96042 ad6331 96039->96042 96046 a91940 9 API calls 96041->96046 96043 ad633d 96042->96043 96291 b0709c 349 API calls 96042->96291 96043->96014 96045 a917ba 96048 a917fb 96045->96048 96050 a89cb3 22 API calls 96045->96050 96047 a913a0 96046->96047 96049 a91940 9 API calls 96047->96049 96052 ad6346 96048->96052 96054 a9182c 96048->96054 96051 a913b6 96049->96051 96058 a917d4 96050->96058 96051->96048 96053 a913ec 96051->96053 96292 af359c 82 API calls __wsopen_s 96052->96292 96053->96052 96078 a91408 __fread_nolock 96053->96078 96279 a8aceb 96054->96279 96057 a91839 96289 a9d217 349 API calls 96057->96289 96278 aa01f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 96058->96278 96061 ad636e 96293 af359c 82 API calls __wsopen_s 96061->96293 96062 a9152f 96064 a9153c 96062->96064 96065 ad63d1 96062->96065 96066 a91940 9 API calls 96064->96066 96295 b05745 54 API calls _wcslen 96065->96295 96068 a91549 96066->96068 96072 a91940 9 API calls 96068->96072 96083 a915c7 messages 96068->96083 96069 a9fddb 22 API calls 96069->96078 96070 a9fe0b 22 API calls 96070->96078 96071 a91872 96290 a9faeb 23 API calls 96071->96290 96079 a91563 96072->96079 96073 a9171d 96073->96014 96076 a8ec40 349 API calls 96076->96078 96077 a9167b messages 96077->96073 96276 a9ce17 22 API calls messages 96077->96276 96078->96057 96078->96061 96078->96062 96078->96069 96078->96070 96078->96076 96080 ad63b2 96078->96080 96078->96083 96079->96083 96296 a8a8c7 22 API calls __fread_nolock 96079->96296 96294 af359c 82 API calls __wsopen_s 96080->96294 96082 a91940 9 API calls 96082->96083 96083->96071 96083->96077 96083->96082 96229 b0ab67 96083->96229 96232 b119bc 96083->96232 96235 a9f645 96083->96235 96242 b129bf 96083->96242 96246 b0abf7 96083->96246 96251 af5c5a 96083->96251 96256 b0a67c CreateToolhelp32Snapshot Process32FirstW 96083->96256 96297 af359c 82 API calls __wsopen_s 96083->96297 96548 a8adf0 96093->96548 96095 a8bf9d 96096 a8bfa9 96095->96096 96097 ad04b6 96095->96097 96099 ad04c6 96096->96099 96100 a8c01e 96096->96100 96566 af359c 82 API calls __wsopen_s 96097->96566 96567 af359c 82 API calls __wsopen_s 96099->96567 96553 a8ac91 96100->96553 96103 a8c7da 96107 a9fe0b 22 API calls 96103->96107 96113 a8c808 __fread_nolock 96107->96113 96110 ad04f5 96112 ad055a 96110->96112 96568 a9d217 349 API calls 96110->96568 96138 a8c603 96112->96138 96569 af359c 82 API calls __wsopen_s 96112->96569 96116 a9fe0b 22 API calls 96113->96116 96114 ae7120 22 API calls 96148 a8c039 __fread_nolock messages 96114->96148 96115 ad091a 96578 af3209 23 API calls 96115->96578 96149 a8c350 __fread_nolock messages 96116->96149 96117 a8af8a 22 API calls 96117->96148 96120 a8ec40 349 API calls 96120->96148 96121 ad08a5 96122 a8ec40 349 API calls 96121->96122 96124 ad08cf 96122->96124 96124->96138 96576 a8a81b 41 API calls 96124->96576 96125 ad0591 96570 af359c 82 API calls __wsopen_s 96125->96570 96126 ad08f6 96577 af359c 82 API calls __wsopen_s 96126->96577 96131 a8bbe0 40 API calls 96131->96148 96132 a8aceb 23 API calls 96132->96148 96133 a9fddb 22 API calls 96133->96148 96134 a8c237 96135 a8c253 96134->96135 96579 a8a8c7 22 API calls __fread_nolock 96134->96579 96139 ad0976 96135->96139 96143 a8c297 messages 96135->96143 96136 a9fe0b 22 API calls 96136->96148 96138->96014 96141 a8aceb 23 API calls 96139->96141 96142 ad09bf 96141->96142 96142->96138 96580 af359c 82 API calls __wsopen_s 96142->96580 96143->96142 96144 a8aceb 23 API calls 96143->96144 96145 a8c335 96144->96145 96145->96142 96146 a8c342 96145->96146 96564 a8a704 22 API calls messages 96146->96564 96148->96103 96148->96110 96148->96112 96148->96113 96148->96114 96148->96115 96148->96117 96148->96120 96148->96121 96148->96125 96148->96126 96148->96131 96148->96132 96148->96133 96148->96134 96148->96136 96148->96138 96148->96142 96557 a8ad81 96148->96557 96571 ae7099 22 API calls __fread_nolock 96148->96571 96572 b05745 54 API calls _wcslen 96148->96572 96573 a9aa42 22 API calls messages 96148->96573 96574 aef05c 40 API calls 96148->96574 96575 a8a993 41 API calls 96148->96575 96150 a8c3ac 96149->96150 96565 a9ce17 22 API calls messages 96149->96565 96150->96014 96152 a9ee09 96151->96152 96153 a9ee12 96151->96153 96152->96014 96153->96152 96154 a9ee36 IsDialogMessageW 96153->96154 96155 adefaf GetClassLongW 96153->96155 96154->96152 96154->96153 96155->96153 96155->96154 96156->96014 96157->96014 96158->96014 96159->96014 96180 a8ec76 messages 96160->96180 96161 aa00a3 29 API calls pre_c_initialization 96161->96180 96162 ad4beb 96597 af359c 82 API calls __wsopen_s 96162->96597 96163 a8fef7 96177 a8ed9d messages 96163->96177 96593 a8a8c7 22 API calls __fread_nolock 96163->96593 96166 a9fddb 22 API calls 96166->96180 96167 ad4b0b 96595 af359c 82 API calls __wsopen_s 96167->96595 96168 a8f3ae messages 96168->96177 96594 af359c 82 API calls __wsopen_s 96168->96594 96169 ad4600 96169->96177 96592 a8a8c7 22 API calls __fread_nolock 96169->96592 96173 a8a8c7 22 API calls 96173->96180 96176 aa0242 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 96176->96180 96177->96014 96178 a8fbe3 96178->96168 96178->96177 96181 ad4bdc 96178->96181 96179 a8a961 22 API calls 96179->96180 96180->96161 96180->96162 96180->96163 96180->96166 96180->96167 96180->96168 96180->96169 96180->96173 96180->96176 96180->96177 96180->96178 96180->96179 96183 aa01f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent __Init_thread_footer 96180->96183 96590 a901e0 349 API calls 2 library calls 96180->96590 96591 a906a0 41 API calls messages 96180->96591 96596 af359c 82 API calls __wsopen_s 96181->96596 96183->96180 96184->96014 96185->96020 96186->96020 96187->96020 96188->96020 96190 a8ec40 349 API calls 96189->96190 96195 a8d29d 96190->96195 96191 ad1bc4 96228 af359c 82 API calls __wsopen_s 96191->96228 96193 a8d30b messages 96193->96034 96194 a8d6d5 96194->96193 96205 a9fe0b 22 API calls 96194->96205 96195->96191 96195->96193 96195->96194 96196 a8d3c3 96195->96196 96199 a8d4b8 96195->96199 96210 a9fddb 22 API calls 96195->96210 96216 a8d429 __fread_nolock messages 96195->96216 96196->96194 96198 a8d3ce 96196->96198 96197 a8d5ff 96201 ad1bb5 96197->96201 96202 a8d614 96197->96202 96200 a9fddb 22 API calls 96198->96200 96207 a9fe0b 22 API calls 96199->96207 96206 a8d3d5 __fread_nolock 96200->96206 96227 b05705 23 API calls 96201->96227 96204 a9fddb 22 API calls 96202->96204 96214 a8d46a 96204->96214 96205->96206 96208 a8d3f6 96206->96208 96209 a9fddb 22 API calls 96206->96209 96207->96216 96208->96216 96222 a8bec0 349 API calls 96208->96222 96209->96208 96210->96195 96212 ad1ba4 96226 af359c 82 API calls __wsopen_s 96212->96226 96214->96034 96216->96197 96216->96212 96216->96214 96217 ad1b7f 96216->96217 96219 ad1b5d 96216->96219 96223 a81f6f 349 API calls 96216->96223 96225 af359c 82 API calls __wsopen_s 96217->96225 96224 af359c 82 API calls __wsopen_s 96219->96224 96221->96036 96222->96216 96223->96216 96224->96214 96225->96214 96226->96214 96227->96191 96228->96193 96298 b0aff9 96229->96298 96453 b12ad8 96232->96453 96234 b119cb 96234->96083 96236 a8b567 39 API calls 96235->96236 96237 a9f659 96236->96237 96238 adf2dc Sleep 96237->96238 96239 a9f661 timeGetTime 96237->96239 96240 a8b567 39 API calls 96239->96240 96241 a9f677 96240->96241 96241->96083 96243 b129cb 96242->96243 96244 b12a01 GetForegroundWindow 96243->96244 96245 b129d1 96243->96245 96244->96245 96245->96083 96247 b0aff9 217 API calls 96246->96247 96249 b0ac0c 96247->96249 96248 b0ac54 96248->96083 96249->96248 96250 a8aceb 23 API calls 96249->96250 96250->96248 96252 a87510 53 API calls 96251->96252 96253 af5c6d 96252->96253 96464 aedbbe lstrlenW 96253->96464 96255 af5c77 96255->96083 96264 b0a6c3 96256->96264 96257 a8a961 22 API calls 96257->96264 96258 a89cb3 22 API calls 96258->96264 96260 a86350 22 API calls 96260->96264 96262 a87510 53 API calls 96262->96264 96264->96257 96264->96258 96264->96260 96264->96262 96265 b0a796 Process32NextW 96264->96265 96469 a8525f 96264->96469 96517 a9ce60 41 API calls 96264->96517 96518 b0b574 22 API calls __fread_nolock 96264->96518 96265->96264 96266 b0a7aa CloseHandle 96265->96266 96511 a863eb 96266->96511 96270 b0a7cd 96520 a904f0 22 API calls 96270->96520 96272 b0a87d 96272->96083 96273 a904f0 22 API calls 96275 b0a7d9 96273->96275 96275->96272 96275->96273 96521 a862b5 22 API calls 96275->96521 96276->96077 96277->96045 96278->96048 96280 a8acf9 96279->96280 96282 a8ad2a messages 96279->96282 96281 a8ad55 96280->96281 96284 a8ad01 messages 96280->96284 96281->96282 96546 a8a8c7 22 API calls __fread_nolock 96281->96546 96282->96057 96284->96282 96285 acfa48 96284->96285 96286 a8ad21 96284->96286 96285->96282 96547 a9ce17 22 API calls messages 96285->96547 96286->96282 96287 acfa3a VariantClear 96286->96287 96287->96282 96289->96071 96290->96071 96291->96043 96292->96083 96293->96083 96294->96083 96295->96079 96296->96083 96297->96083 96299 b0b01d ___scrt_fastfail 96298->96299 96300 b0b094 96299->96300 96301 b0b058 96299->96301 96303 a8b567 39 API calls 96300->96303 96308 b0b08b 96300->96308 96419 a8b567 96301->96419 96307 b0b0a5 96303->96307 96304 b0b063 96304->96308 96312 a8b567 39 API calls 96304->96312 96305 b0b0ed 96389 a87510 96305->96389 96311 a8b567 39 API calls 96307->96311 96308->96305 96309 a8b567 39 API calls 96308->96309 96309->96305 96311->96308 96314 b0b078 96312->96314 96315 a8b567 39 API calls 96314->96315 96315->96308 96316 b0b115 96317 b0b1d8 96316->96317 96318 b0b11f 96316->96318 96319 b0b20a GetCurrentDirectoryW 96317->96319 96321 a87510 53 API calls 96317->96321 96320 a87510 53 API calls 96318->96320 96322 a9fe0b 22 API calls 96319->96322 96323 b0b130 96320->96323 96324 b0b1ef 96321->96324 96325 b0b22f GetCurrentDirectoryW 96322->96325 96326 a87620 22 API calls 96323->96326 96327 a87620 22 API calls 96324->96327 96328 b0b23c 96325->96328 96329 b0b13a 96326->96329 96330 b0b1f9 _wcslen 96327->96330 96332 b0b275 96328->96332 96424 a89c6e 22 API calls 96328->96424 96331 a87510 53 API calls 96329->96331 96330->96319 96330->96332 96333 b0b14b 96331->96333 96340 b0b287 96332->96340 96341 b0b28b 96332->96341 96335 a87620 22 API calls 96333->96335 96337 b0b155 96335->96337 96336 b0b255 96425 a89c6e 22 API calls 96336->96425 96339 a87510 53 API calls 96337->96339 96343 b0b166 96339->96343 96345 b0b2f8 96340->96345 96346 b0b39a CreateProcessW 96340->96346 96427 af07c0 10 API calls 96341->96427 96342 b0b265 96426 a89c6e 22 API calls 96342->96426 96348 a87620 22 API calls 96343->96348 96430 ae11c8 39 API calls 96345->96430 96388 b0b32f _wcslen 96346->96388 96351 b0b170 96348->96351 96349 b0b294 96428 af06e6 10 API calls 96349->96428 96354 b0b1a6 GetSystemDirectoryW 96351->96354 96358 a87510 53 API calls 96351->96358 96353 b0b2fd 96356 b0b323 96353->96356 96357 b0b32a 96353->96357 96360 a9fe0b 22 API calls 96354->96360 96355 b0b2aa 96429 af05a7 8 API calls 96355->96429 96431 ae1201 128 API calls 2 library calls 96356->96431 96432 ae14ce 6 API calls 96357->96432 96362 b0b187 96358->96362 96365 b0b1cb GetSystemDirectoryW 96360->96365 96367 a87620 22 API calls 96362->96367 96364 b0b2d0 96364->96340 96365->96328 96366 b0b328 96366->96388 96370 b0b191 _wcslen 96367->96370 96368 b0b3d6 GetLastError 96380 b0b41a 96368->96380 96369 b0b42f CloseHandle 96371 b0b43f 96369->96371 96381 b0b49a 96369->96381 96370->96328 96370->96354 96373 b0b451 96371->96373 96374 b0b446 CloseHandle 96371->96374 96376 b0b463 96373->96376 96377 b0b458 CloseHandle 96373->96377 96374->96373 96375 b0b4a6 96375->96380 96378 b0b475 96376->96378 96379 b0b46a CloseHandle 96376->96379 96377->96376 96433 af09d9 34 API calls 96378->96433 96379->96378 96416 af0175 96380->96416 96381->96375 96386 b0b4d2 CloseHandle 96381->96386 96385 b0b486 96434 b0b536 25 API calls 96385->96434 96386->96380 96388->96368 96388->96369 96390 a87525 96389->96390 96407 a87522 96389->96407 96391 a8755b 96390->96391 96392 a8752d 96390->96392 96396 ac500f 96391->96396 96397 a8756d 96391->96397 96403 ac50f6 96391->96403 96435 aa51c6 26 API calls 96392->96435 96394 a8753d 96402 a9fddb 22 API calls 96394->96402 96398 ac5088 96396->96398 96406 a9fe0b 22 API calls 96396->96406 96436 a9fb21 51 API calls 96397->96436 96437 a9fb21 51 API calls 96398->96437 96399 ac510e 96399->96399 96404 a87547 96402->96404 96438 aa5183 26 API calls 96403->96438 96405 a89cb3 22 API calls 96404->96405 96405->96407 96408 ac5058 96406->96408 96412 a87620 96407->96412 96409 a9fddb 22 API calls 96408->96409 96410 ac507f 96409->96410 96411 a89cb3 22 API calls 96410->96411 96411->96398 96413 a8762a _wcslen 96412->96413 96414 a9fe0b 22 API calls 96413->96414 96415 a8763f 96414->96415 96415->96316 96439 af030f 96416->96439 96420 a8b57f 96419->96420 96421 a8b578 96419->96421 96420->96304 96421->96420 96452 aa62d1 39 API calls 96421->96452 96423 a8b5c2 96423->96304 96424->96336 96425->96342 96426->96332 96427->96349 96428->96355 96429->96364 96430->96353 96431->96366 96432->96388 96433->96385 96434->96381 96435->96394 96436->96394 96437->96403 96438->96399 96440 af0329 96439->96440 96441 af0321 CloseHandle 96439->96441 96442 af032e CloseHandle 96440->96442 96443 af0336 96440->96443 96441->96440 96442->96443 96444 af033b CloseHandle 96443->96444 96445 af0343 96443->96445 96444->96445 96446 af0348 CloseHandle 96445->96446 96447 af0350 96445->96447 96446->96447 96448 af035d 96447->96448 96449 af0355 CloseHandle 96447->96449 96450 af017d 96448->96450 96451 af0362 CloseHandle 96448->96451 96449->96448 96450->96083 96451->96450 96452->96423 96454 a8aceb 23 API calls 96453->96454 96455 b12af3 96454->96455 96456 b12b1d 96455->96456 96457 b12aff 96455->96457 96458 a86b57 22 API calls 96456->96458 96459 a87510 53 API calls 96457->96459 96460 b12b1b 96458->96460 96461 b12b0c 96459->96461 96460->96234 96461->96460 96463 a8a8c7 22 API calls __fread_nolock 96461->96463 96463->96460 96465 aedbdc GetFileAttributesW 96464->96465 96466 aedc06 96464->96466 96465->96466 96467 aedbe8 FindFirstFileW 96465->96467 96466->96255 96467->96466 96468 aedbf9 FindClose 96467->96468 96468->96466 96470 a8a961 22 API calls 96469->96470 96471 a85275 96470->96471 96472 a8a961 22 API calls 96471->96472 96473 a8527d 96472->96473 96474 a8a961 22 API calls 96473->96474 96475 a85285 96474->96475 96476 a8a961 22 API calls 96475->96476 96477 a8528d 96476->96477 96478 ac3df5 96477->96478 96479 a852c1 96477->96479 96540 a8a8c7 22 API calls __fread_nolock 96478->96540 96481 a86d25 22 API calls 96479->96481 96483 a852cf 96481->96483 96482 ac3dfe 96484 a8a6c3 22 API calls 96482->96484 96485 a893b2 22 API calls 96483->96485 96487 a85304 96484->96487 96486 a852d9 96485->96486 96486->96487 96488 a86d25 22 API calls 96486->96488 96489 a85349 96487->96489 96490 a85325 96487->96490 96506 ac3e20 96487->96506 96492 a852fa 96488->96492 96522 a86d25 96489->96522 96490->96489 96535 a84c6d 96490->96535 96494 a893b2 22 API calls 96492->96494 96493 a8535a 96495 a85370 96493->96495 96538 a8a8c7 22 API calls __fread_nolock 96493->96538 96494->96487 96497 a85384 96495->96497 96539 a8a8c7 22 API calls __fread_nolock 96495->96539 96501 a8538f 96497->96501 96542 a8a8c7 22 API calls __fread_nolock 96497->96542 96499 a86b57 22 API calls 96508 ac3ee0 96499->96508 96509 a8539a 96501->96509 96543 a8a8c7 22 API calls __fread_nolock 96501->96543 96503 a86d25 22 API calls 96503->96489 96506->96499 96507 a84c6d 22 API calls 96507->96508 96508->96489 96508->96507 96541 a849bd 22 API calls __fread_nolock 96508->96541 96509->96264 96512 a863f3 96511->96512 96513 a9fddb 22 API calls 96512->96513 96514 a86401 96513->96514 96545 a86a26 22 API calls 96514->96545 96516 a86409 96519 a86a50 22 API calls 96516->96519 96517->96264 96518->96264 96519->96270 96520->96275 96521->96275 96523 a86d91 96522->96523 96524 a86d34 96522->96524 96525 a893b2 22 API calls 96523->96525 96524->96523 96526 a86d3f 96524->96526 96532 a86d62 __fread_nolock 96525->96532 96527 ac4c9d 96526->96527 96528 a86d5a 96526->96528 96529 a9fddb 22 API calls 96527->96529 96544 a86f34 22 API calls 96528->96544 96531 ac4ca7 96529->96531 96533 a9fe0b 22 API calls 96531->96533 96532->96493 96534 ac4cda 96533->96534 96536 a8aec9 22 API calls 96535->96536 96537 a84c78 96536->96537 96537->96489 96537->96503 96538->96495 96539->96497 96540->96482 96541->96508 96542->96501 96543->96509 96544->96532 96545->96516 96546->96282 96547->96282 96549 a8ae01 96548->96549 96552 a8ae1c messages 96548->96552 96550 a8aec9 22 API calls 96549->96550 96551 a8ae09 CharUpperBuffW 96550->96551 96551->96552 96552->96095 96554 a8acae 96553->96554 96555 a8acd1 96554->96555 96581 af359c 82 API calls __wsopen_s 96554->96581 96555->96148 96558 acfadb 96557->96558 96559 a8ad92 96557->96559 96560 a9fddb 22 API calls 96559->96560 96561 a8ad99 96560->96561 96582 a8adcd 96561->96582 96564->96149 96565->96149 96566->96099 96567->96138 96568->96112 96569->96138 96570->96138 96571->96148 96572->96148 96573->96148 96574->96148 96575->96148 96576->96126 96577->96138 96578->96134 96579->96135 96580->96138 96581->96555 96586 a8addd 96582->96586 96583 a8adb6 96583->96148 96584 a9fddb 22 API calls 96584->96586 96585 a8a961 22 API calls 96585->96586 96586->96583 96586->96584 96586->96585 96588 a8adcd 22 API calls 96586->96588 96589 a8a8c7 22 API calls __fread_nolock 96586->96589 96588->96586 96589->96586 96590->96180 96591->96180 96592->96177 96593->96177 96594->96177 96595->96177 96596->96162 96597->96177 96598 ac2402 96601 a81410 96598->96601 96602 ac24b8 DestroyWindow 96601->96602 96603 a8144f mciSendStringW 96601->96603 96616 ac24c4 96602->96616 96604 a8146b 96603->96604 96605 a816c6 96603->96605 96606 a81479 96604->96606 96604->96616 96605->96604 96607 a816d5 UnregisterHotKey 96605->96607 96634 a8182e 96606->96634 96607->96605 96610 ac2509 96615 ac252d 96610->96615 96617 ac251c FreeLibrary 96610->96617 96611 ac24d8 96611->96616 96640 a86246 CloseHandle 96611->96640 96612 ac24e2 FindClose 96612->96616 96614 a8148e 96614->96615 96623 a8149c 96614->96623 96618 ac2541 VirtualFree 96615->96618 96625 a81509 96615->96625 96616->96610 96616->96611 96616->96612 96617->96610 96618->96615 96619 a814f8 CoUninitialize 96619->96625 96620 ac2589 96627 ac2598 messages 96620->96627 96641 af32eb 6 API calls messages 96620->96641 96621 a81514 96622 a81524 96621->96622 96638 a81944 VirtualFreeEx CloseHandle 96622->96638 96623->96619 96625->96620 96625->96621 96630 ac2627 96627->96630 96642 ae64d4 22 API calls messages 96627->96642 96629 a8153a 96629->96627 96631 a8161f 96629->96631 96630->96630 96631->96630 96639 a81876 CloseHandle InternetCloseHandle InternetCloseHandle WaitForSingleObject 96631->96639 96633 a816c1 96636 a8183b 96634->96636 96635 a81480 96635->96610 96635->96614 96636->96635 96643 ae702a 22 API calls 96636->96643 96638->96629 96639->96633 96640->96611 96641->96620 96642->96627 96643->96636 96644 a81098 96649 a842de 96644->96649 96648 a810a7 96650 a8a961 22 API calls 96649->96650 96651 a842f5 GetVersionExW 96650->96651 96652 a86b57 22 API calls 96651->96652 96653 a84342 96652->96653 96654 a893b2 22 API calls 96653->96654 96666 a84378 96653->96666 96655 a8436c 96654->96655 96657 a837a0 22 API calls 96655->96657 96656 a8441b GetCurrentProcess IsWow64Process 96658 a84437 96656->96658 96657->96666 96659 a8444f LoadLibraryA 96658->96659 96660 ac3824 GetSystemInfo 96658->96660 96661 a8449c GetSystemInfo 96659->96661 96662 a84460 GetProcAddress 96659->96662 96663 a84476 96661->96663 96662->96661 96665 a84470 GetNativeSystemInfo 96662->96665 96667 a8447a FreeLibrary 96663->96667 96668 a8109d 96663->96668 96664 ac37df 96665->96663 96666->96656 96666->96664 96667->96668 96669 aa00a3 29 API calls __onexit 96668->96669 96669->96648 96670 aa03fb 96671 aa0407 ___scrt_is_nonwritable_in_current_image 96670->96671 96699 a9feb1 96671->96699 96673 aa040e 96674 aa0561 96673->96674 96677 aa0438 96673->96677 96729 aa083f IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter ___scrt_fastfail 96674->96729 96676 aa0568 96722 aa4e52 96676->96722 96688 aa0477 ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock 96677->96688 96710 ab247d 96677->96710 96684 aa0457 96686 aa04d8 96718 aa0959 96686->96718 96688->96686 96725 aa4e1a 38 API calls 3 library calls 96688->96725 96690 aa04de 96691 aa04f3 96690->96691 96726 aa0992 GetModuleHandleW 96691->96726 96693 aa04fa 96693->96676 96694 aa04fe 96693->96694 96695 aa0507 96694->96695 96727 aa4df5 28 API calls _abort 96694->96727 96728 aa0040 13 API calls 2 library calls 96695->96728 96698 aa050f 96698->96684 96700 a9feba 96699->96700 96731 aa0698 IsProcessorFeaturePresent 96700->96731 96702 a9fec6 96732 aa2c94 10 API calls 3 library calls 96702->96732 96704 a9fecb 96705 a9fecf 96704->96705 96733 ab2317 IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 96704->96733 96705->96673 96707 a9fed8 96708 a9fee6 96707->96708 96734 aa2cbd 8 API calls 3 library calls 96707->96734 96708->96673 96711 ab2494 96710->96711 96735 aa0a8c 96711->96735 96713 aa0451 96713->96684 96714 ab2421 96713->96714 96715 ab2450 96714->96715 96716 aa0a8c __ehhandler$?_ScheduleContinuationTask@_Task_impl_base@details@Concurrency@@QAEXPAU_ContinuationTaskHandleBase@23@@Z 5 API calls 96715->96716 96717 ab2479 96716->96717 96717->96688 96743 aa2340 96718->96743 96721 aa097f 96721->96690 96745 aa4bcf 96722->96745 96725->96686 96726->96693 96727->96695 96728->96698 96729->96676 96731->96702 96732->96704 96733->96707 96734->96705 96736 aa0a97 IsProcessorFeaturePresent 96735->96736 96737 aa0a95 96735->96737 96739 aa0c5d 96736->96739 96737->96713 96742 aa0c21 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 96739->96742 96741 aa0d40 96741->96713 96742->96741 96744 aa096c GetStartupInfoW 96743->96744 96744->96721 96746 aa4bdb FindHandler 96745->96746 96747 aa4be2 96746->96747 96748 aa4bf4 96746->96748 96784 aa4d29 GetModuleHandleW 96747->96784 96769 ab2f5e EnterCriticalSection 96748->96769 96751 aa4be7 96751->96748 96785 aa4d6d GetModuleHandleExW 96751->96785 96752 aa4c99 96773 aa4cd9 96752->96773 96755 aa4bfb 96755->96752 96757 aa4c70 96755->96757 96770 ab21a8 96755->96770 96759 aa4c88 96757->96759 96763 ab2421 _abort 5 API calls 96757->96763 96764 ab2421 _abort 5 API calls 96759->96764 96760 aa4ce2 96793 ac1d29 5 API calls __ehhandler$?_ScheduleContinuationTask@_Task_impl_base@details@Concurrency@@QAEXPAU_ContinuationTaskHandleBase@23@@Z 96760->96793 96761 aa4cb6 96776 aa4ce8 96761->96776 96763->96759 96764->96752 96769->96755 96794 ab1ee1 96770->96794 96813 ab2fa6 LeaveCriticalSection 96773->96813 96775 aa4cb2 96775->96760 96775->96761 96814 ab360c 96776->96814 96779 aa4d16 96782 aa4d6d _abort 8 API calls 96779->96782 96780 aa4cf6 GetPEB 96780->96779 96781 aa4d06 GetCurrentProcess TerminateProcess 96780->96781 96781->96779 96783 aa4d1e ExitProcess 96782->96783 96784->96751 96786 aa4dba 96785->96786 96787 aa4d97 GetProcAddress 96785->96787 96789 aa4dc9 96786->96789 96790 aa4dc0 FreeLibrary 96786->96790 96788 aa4dac 96787->96788 96788->96786 96791 aa0a8c __ehhandler$?_ScheduleContinuationTask@_Task_impl_base@details@Concurrency@@QAEXPAU_ContinuationTaskHandleBase@23@@Z 5 API calls 96789->96791 96790->96789 96792 aa4bf3 96791->96792 96792->96748 96797 ab1e90 96794->96797 96796 ab1f05 96796->96757 96798 ab1e9c ___scrt_is_nonwritable_in_current_image 96797->96798 96805 ab2f5e EnterCriticalSection 96798->96805 96800 ab1eaa 96806 ab1f31 96800->96806 96804 ab1ec8 __fread_nolock 96804->96796 96805->96800 96809 ab1f51 96806->96809 96810 ab1f59 96806->96810 96807 aa0a8c __ehhandler$?_ScheduleContinuationTask@_Task_impl_base@details@Concurrency@@QAEXPAU_ContinuationTaskHandleBase@23@@Z 5 API calls 96808 ab1eb7 96807->96808 96812 ab1ed5 LeaveCriticalSection _abort 96808->96812 96809->96807 96810->96809 96811 ab29c8 _free 20 API calls 96810->96811 96811->96809 96812->96804 96813->96775 96815 ab3631 96814->96815 96816 ab3627 96814->96816 96821 ab2fd7 5 API calls 2 library calls 96815->96821 96818 aa0a8c __ehhandler$?_ScheduleContinuationTask@_Task_impl_base@details@Concurrency@@QAEXPAU_ContinuationTaskHandleBase@23@@Z 5 API calls 96816->96818 96820 aa4cf2 96818->96820 96819 ab3648 96819->96816 96820->96779 96820->96780 96821->96819 96822 a8105b 96827 a8344d 96822->96827 96824 a8106a 96858 aa00a3 29 API calls __onexit 96824->96858 96826 a81074 96828 a8345d __wsopen_s 96827->96828 96829 a8a961 22 API calls 96828->96829 96830 a83513 96829->96830 96831 a83a5a 24 API calls 96830->96831 96832 a8351c 96831->96832 96859 a83357 96832->96859 96835 a833c6 22 API calls 96836 a83535 96835->96836 96837 a8515f 22 API calls 96836->96837 96838 a83544 96837->96838 96839 a8a961 22 API calls 96838->96839 96840 a8354d 96839->96840 96841 a8a6c3 22 API calls 96840->96841 96842 a83556 RegOpenKeyExW 96841->96842 96843 ac3176 RegQueryValueExW 96842->96843 96847 a83578 96842->96847 96844 ac320c RegCloseKey 96843->96844 96845 ac3193 96843->96845 96844->96847 96856 ac321e _wcslen 96844->96856 96846 a9fe0b 22 API calls 96845->96846 96848 ac31ac 96846->96848 96847->96824 96849 a85722 22 API calls 96848->96849 96850 ac31b7 RegQueryValueExW 96849->96850 96852 ac31d4 96850->96852 96854 ac31ee messages 96850->96854 96851 a84c6d 22 API calls 96851->96856 96853 a86b57 22 API calls 96852->96853 96853->96854 96854->96844 96855 a89cb3 22 API calls 96855->96856 96856->96847 96856->96851 96856->96855 96857 a8515f 22 API calls 96856->96857 96857->96856 96858->96826 96860 ac1f50 __wsopen_s 96859->96860 96861 a83364 GetFullPathNameW 96860->96861 96862 a83386 96861->96862 96863 a86b57 22 API calls 96862->96863 96864 a833a4 96863->96864 96864->96835 96865 a8dddc 96868 a8b710 96865->96868 96869 a8b72b 96868->96869 96870 ad00f8 96869->96870 96871 ad0146 96869->96871 96898 a8b750 96869->96898 96874 ad0102 96870->96874 96877 ad010f 96870->96877 96870->96898 96910 b058a2 349 API calls 2 library calls 96871->96910 96908 b05d33 349 API calls 96874->96908 96890 a8ba20 96877->96890 96909 b061d0 349 API calls 2 library calls 96877->96909 96880 a9d336 40 API calls 96880->96898 96881 ad03d9 96881->96881 96885 a8ba4e 96886 ad0322 96913 b05c0c 82 API calls 96886->96913 96890->96885 96914 af359c 82 API calls __wsopen_s 96890->96914 96893 a8aceb 23 API calls 96893->96898 96894 a8bbe0 40 API calls 96894->96898 96895 a8ec40 349 API calls 96895->96898 96898->96880 96898->96885 96898->96886 96898->96890 96898->96893 96898->96894 96898->96895 96899 a8a81b 41 API calls 96898->96899 96900 a9d2f0 40 API calls 96898->96900 96901 a9a01b 349 API calls 96898->96901 96902 aa0242 5 API calls __Init_thread_wait 96898->96902 96903 a9edcd 22 API calls 96898->96903 96904 aa00a3 29 API calls __onexit 96898->96904 96905 aa01f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 96898->96905 96906 a9ee53 82 API calls 96898->96906 96907 a9e5ca 349 API calls 96898->96907 96911 adf6bf 23 API calls 96898->96911 96912 a8a8c7 22 API calls __fread_nolock 96898->96912 96899->96898 96900->96898 96901->96898 96902->96898 96903->96898 96904->96898 96905->96898 96906->96898 96907->96898 96908->96877 96909->96890 96910->96898 96911->96898 96912->96898 96913->96890 96914->96881 96915 a8f7bf 96916 a8f7d3 96915->96916 96917 a8fcb6 96915->96917 96918 a8fcc2 96916->96918 96920 a9fddb 22 API calls 96916->96920 96919 a8aceb 23 API calls 96917->96919 96921 a8aceb 23 API calls 96918->96921 96919->96918 96922 a8f7e5 96920->96922 96924 a8fd3d 96921->96924 96922->96918 96923 a8f83e 96922->96923 96922->96924 96926 a91310 349 API calls 96923->96926 96941 a8ed9d messages 96923->96941 96952 af1155 22 API calls 96924->96952 96937 a8ec76 messages 96926->96937 96927 ad4beb 96958 af359c 82 API calls __wsopen_s 96927->96958 96928 a8fef7 96928->96941 96954 a8a8c7 22 API calls __fread_nolock 96928->96954 96931 ad4b0b 96956 af359c 82 API calls __wsopen_s 96931->96956 96932 a8a8c7 22 API calls 96932->96937 96933 a8f3ae messages 96933->96941 96955 af359c 82 API calls __wsopen_s 96933->96955 96934 ad4600 96934->96941 96953 a8a8c7 22 API calls __fread_nolock 96934->96953 96937->96927 96937->96928 96937->96931 96937->96932 96937->96933 96937->96934 96940 aa0242 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 96937->96940 96937->96941 96943 a8fbe3 96937->96943 96944 a8a961 22 API calls 96937->96944 96947 aa01f8 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent __Init_thread_footer 96937->96947 96948 aa00a3 29 API calls pre_c_initialization 96937->96948 96949 a9fddb 22 API calls 96937->96949 96950 a901e0 349 API calls 2 library calls 96937->96950 96951 a906a0 41 API calls messages 96937->96951 96940->96937 96943->96933 96943->96941 96945 ad4bdc 96943->96945 96944->96937 96957 af359c 82 API calls __wsopen_s 96945->96957 96947->96937 96948->96937 96949->96937 96950->96937 96951->96937 96952->96941 96953->96941 96954->96941 96955->96941 96956->96941 96957->96927 96958->96941 96959 ad3f75 96970 a9ceb1 96959->96970 96961 ad3f8b 96962 ad4006 96961->96962 96979 a9e300 23 API calls 96961->96979 96965 a8bf40 349 API calls 96962->96965 96964 ad3fe6 96967 ad4052 96964->96967 96980 af1abf 22 API calls 96964->96980 96965->96967 96969 ad4a88 96967->96969 96981 af359c 82 API calls __wsopen_s 96967->96981 96971 a9cebf 96970->96971 96972 a9ced2 96970->96972 96973 a8aceb 23 API calls 96971->96973 96974 a9cf05 96972->96974 96975 a9ced7 96972->96975 96978 a9cec9 96973->96978 96977 a8aceb 23 API calls 96974->96977 96976 a9fddb 22 API calls 96975->96976 96976->96978 96977->96978 96978->96961 96979->96964 96980->96962 96981->96969 96982 a81033 96987 a84c91 96982->96987 96986 a81042 96988 a8a961 22 API calls 96987->96988 96989 a84cff 96988->96989 96995 a83af0 96989->96995 96992 a84d9c 96993 a81038 96992->96993 96998 a851f7 22 API calls __fread_nolock 96992->96998 96994 aa00a3 29 API calls __onexit 96993->96994 96994->96986 96999 a83b1c 96995->96999 96998->96992 97000 a83b0f 96999->97000 97001 a83b29 96999->97001 97000->96992 97001->97000 97002 a83b30 RegOpenKeyExW 97001->97002 97002->97000 97003 a83b4a RegQueryValueExW 97002->97003 97004 a83b6b 97003->97004 97005 a83b80 RegCloseKey 97003->97005 97004->97005 97005->97000 97006 a83156 97009 a83170 97006->97009 97010 a83187 97009->97010 97011 a831eb 97010->97011 97012 a8318c 97010->97012 97048 a831e9 97010->97048 97016 ac2dfb 97011->97016 97017 a831f1 97011->97017 97013 a83199 97012->97013 97014 a83265 PostQuitMessage 97012->97014 97019 ac2e7c 97013->97019 97020 a831a4 97013->97020 97021 a8316a 97014->97021 97015 a831d0 DefWindowProcW 97015->97021 97064 a818e2 10 API calls 97016->97064 97022 a831f8 97017->97022 97023 a8321d SetTimer RegisterWindowMessageW 97017->97023 97067 aebf30 34 API calls ___scrt_fastfail 97019->97067 97025 ac2e68 97020->97025 97026 a831ae 97020->97026 97029 ac2d9c 97022->97029 97030 a83201 KillTimer 97022->97030 97023->97021 97027 a83246 CreatePopupMenu 97023->97027 97024 ac2e1c 97065 a9e499 42 API calls 97024->97065 97054 aec161 97025->97054 97033 ac2e4d 97026->97033 97034 a831b9 97026->97034 97027->97021 97036 ac2dd7 MoveWindow 97029->97036 97037 ac2da1 97029->97037 97038 a830f2 Shell_NotifyIconW 97030->97038 97033->97015 97066 ae0ad7 22 API calls 97033->97066 97040 a831c4 97034->97040 97041 a83253 97034->97041 97035 ac2e8e 97035->97015 97035->97021 97036->97021 97042 ac2dc6 SetFocus 97037->97042 97043 ac2da7 97037->97043 97039 a83214 97038->97039 97061 a83c50 DeleteObject DestroyWindow 97039->97061 97040->97015 97051 a830f2 Shell_NotifyIconW 97040->97051 97062 a8326f 44 API calls ___scrt_fastfail 97041->97062 97042->97021 97043->97040 97046 ac2db0 97043->97046 97063 a818e2 10 API calls 97046->97063 97048->97015 97049 a83263 97049->97021 97052 ac2e41 97051->97052 97053 a83837 49 API calls 97052->97053 97053->97048 97055 aec179 ___scrt_fastfail 97054->97055 97056 aec276 97054->97056 97057 a83923 24 API calls 97055->97057 97056->97021 97059 aec1a0 97057->97059 97058 aec25f KillTimer SetTimer 97058->97056 97059->97058 97060 aec251 Shell_NotifyIconW 97059->97060 97060->97058 97061->97021 97062->97049 97063->97021 97064->97024 97065->97040 97066->97048 97067->97035 97068 a82e37 97069 a8a961 22 API calls 97068->97069 97070 a82e4d 97069->97070 97147 a84ae3 97070->97147 97072 a82e6b 97073 a83a5a 24 API calls 97072->97073 97074 a82e7f 97073->97074 97075 a89cb3 22 API calls 97074->97075 97076 a82e8c 97075->97076 97077 a84ecb 94 API calls 97076->97077 97078 a82ea5 97077->97078 97079 a82ead 97078->97079 97080 ac2cb0 97078->97080 97161 a8a8c7 22 API calls __fread_nolock 97079->97161 97081 af2cf9 80 API calls 97080->97081 97082 ac2cc3 97081->97082 97083 ac2ccf 97082->97083 97085 a84f39 68 API calls 97082->97085 97088 a84f39 68 API calls 97083->97088 97085->97083 97086 a82ec3 97162 a86f88 22 API calls 97086->97162 97091 ac2ce5 97088->97091 97089 a82ecf 97090 a89cb3 22 API calls 97089->97090 97092 a82edc 97090->97092 97178 a83084 22 API calls 97091->97178 97163 a8a81b 41 API calls 97092->97163 97094 a82eec 97097 a89cb3 22 API calls 97094->97097 97096 ac2d02 97179 a83084 22 API calls 97096->97179 97099 a82f12 97097->97099 97164 a8a81b 41 API calls 97099->97164 97100 ac2d1e 97102 a83a5a 24 API calls 97100->97102 97103 ac2d44 97102->97103 97180 a83084 22 API calls 97103->97180 97104 a82f21 97107 a8a961 22 API calls 97104->97107 97106 ac2d50 97181 a8a8c7 22 API calls __fread_nolock 97106->97181 97109 a82f3f 97107->97109 97165 a83084 22 API calls 97109->97165 97111 ac2d5e 97182 a83084 22 API calls 97111->97182 97112 a82f4b 97166 aa4a28 40 API calls 3 library calls 97112->97166 97115 ac2d6d 97183 a8a8c7 22 API calls __fread_nolock 97115->97183 97116 a82f59 97116->97091 97117 a82f63 97116->97117 97167 aa4a28 40 API calls 3 library calls 97117->97167 97120 ac2d83 97184 a83084 22 API calls 97120->97184 97121 a82f6e 97121->97096 97123 a82f78 97121->97123 97168 aa4a28 40 API calls 3 library calls 97123->97168 97124 ac2d90 97126 a82f83 97126->97100 97127 a82f8d 97126->97127 97169 aa4a28 40 API calls 3 library calls 97127->97169 97129 a82fdc 97129->97115 97130 a82fe8 97129->97130 97130->97124 97134 a863eb 22 API calls 97130->97134 97131 a82f98 97131->97129 97170 a83084 22 API calls 97131->97170 97133 a82fbf 97171 a8a8c7 22 API calls __fread_nolock 97133->97171 97136 a82ff8 97134->97136 97173 a86a50 22 API calls 97136->97173 97137 a82fcd 97172 a83084 22 API calls 97137->97172 97140 a83006 97174 a870b0 23 API calls 97140->97174 97144 a83021 97145 a83065 97144->97145 97175 a86f88 22 API calls 97144->97175 97176 a870b0 23 API calls 97144->97176 97177 a83084 22 API calls 97144->97177 97148 a84af0 __wsopen_s 97147->97148 97149 a86b57 22 API calls 97148->97149 97150 a84b22 97148->97150 97149->97150 97151 a84c6d 22 API calls 97150->97151 97160 a84b58 97150->97160 97151->97150 97152 a89cb3 22 API calls 97154 a84c52 97152->97154 97153 a89cb3 22 API calls 97153->97160 97156 a8515f 22 API calls 97154->97156 97155 a84c6d 22 API calls 97155->97160 97158 a84c5e 97156->97158 97157 a8515f 22 API calls 97157->97160 97158->97072 97159 a84c29 97159->97152 97159->97158 97160->97153 97160->97155 97160->97157 97160->97159 97161->97086 97162->97089 97163->97094 97164->97104 97165->97112 97166->97116 97167->97121 97168->97126 97169->97131 97170->97133 97171->97137 97172->97129 97173->97140 97174->97144 97175->97144 97176->97144 97177->97144 97178->97096 97179->97100 97180->97106 97181->97111 97182->97115 97183->97120 97184->97124

                                                          Executed Functions

                                                          Function 00A842DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235libraryloaderCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 389 a842de-a8434d call a8a961 GetVersionExW call a86b57 394 ac3617-ac362a 389->394 395 a84353 389->395 396 ac362b-ac362f 394->396 397 a84355-a84357 395->397 398 ac3631 396->398 399 ac3632-ac363e 396->399 400 a8435d-a843bc call a893b2 call a837a0 397->400 401 ac3656 397->401 398->399 399->396 402 ac3640-ac3642 399->402 415 ac37df-ac37e6 400->415 416 a843c2-a843c4 400->416 405 ac365d-ac3660 401->405 402->397 404 ac3648-ac364f 402->404 404->394 407 ac3651 404->407 408 a8441b-a84435 GetCurrentProcess IsWow64Process 405->408 409 ac3666-ac36a8 405->409 407->401 412 a84494-a8449a 408->412 413 a84437 408->413 409->408 414 ac36ae-ac36b1 409->414 417 a8443d-a84449 412->417 413->417 418 ac36db-ac36e5 414->418 419 ac36b3-ac36bd 414->419 423 ac37e8 415->423 424 ac3806-ac3809 415->424 416->405 422 a843ca-a843dd 416->422 427 a8444f-a8445e LoadLibraryA 417->427 428 ac3824-ac3828 GetSystemInfo 417->428 425 ac36f8-ac3702 418->425 426 ac36e7-ac36f3 418->426 420 ac36bf-ac36c5 419->420 421 ac36ca-ac36d6 419->421 420->408 421->408 429 ac3726-ac372f 422->429 430 a843e3-a843e5 422->430 431 ac37ee 423->431 434 ac380b-ac381a 424->434 435 ac37f4-ac37fc 424->435 432 ac3704-ac3710 425->432 433 ac3715-ac3721 425->433 426->408 436 a8449c-a844a6 GetSystemInfo 427->436 437 a84460-a8446e GetProcAddress 427->437 441 ac373c-ac3748 429->441 442 ac3731-ac3737 429->442 439 ac374d-ac3762 430->439 440 a843eb-a843ee 430->440 431->435 432->408 433->408 434->431 443 ac381c-ac3822 434->443 435->424 438 a84476-a84478 436->438 437->436 444 a84470-a84474 GetNativeSystemInfo 437->444 449 a8447a-a8447b FreeLibrary 438->449 450 a84481-a84493 438->450 447 ac376f-ac377b 439->447 448 ac3764-ac376a 439->448 445 a843f4-a8440f 440->445 446 ac3791-ac3794 440->446 441->408 442->408 443->435 444->438 451 ac3780-ac378c 445->451 452 a84415 445->452 446->408 453 ac379a-ac37c1 446->453 447->408 448->408 449->450 451->408 452->408 454 ac37ce-ac37da 453->454 455 ac37c3-ac37c9 453->455 454->408 455->408
                                                          APIs
                                                          • GetVersionExW.KERNEL32(?), ref: 00A8430D
                                                            • Part of subcall function 00A86B57: _wcslen.LIBCMT ref: 00A86B6A
                                                          • GetCurrentProcess.KERNEL32(?,00B1CB64,00000000,?,?), ref: 00A84422
                                                          • IsWow64Process.KERNEL32(00000000,?,?), ref: 00A84429
                                                          • LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 00A84454
                                                          • GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00A84466
                                                          • GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 00A84474
                                                          • FreeLibrary.KERNEL32(00000000,?,?), ref: 00A8447B
                                                          • GetSystemInfo.KERNEL32(?,?,?), ref: 00A844A0
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
                                                          • String ID: GetNativeSystemInfo$kernel32.dll$|O
                                                          • API String ID: 3290436268-3101561225
                                                          • Opcode ID: 2daba40f0f0c45baea59a0b80a4b7fa19e3ffb0d23ab8f6025bdc8844bd563d3
                                                          • Instruction ID: a12c3e87b76067585a16437cf56908e7bcbcdc7b61620875501a7d32c3e0d904
                                                          • Opcode Fuzzy Hash: 2daba40f0f0c45baea59a0b80a4b7fa19e3ffb0d23ab8f6025bdc8844bd563d3
                                                          • Instruction Fuzzy Hash: B1A1A17294A3C0FFDB11D76DBC657957FE46F3A346B088CEDD08197A22DA204908CB29
                                                          Function 00A842A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 793 a842a2-a842ba CreateStreamOnHGlobal 794 a842da-a842dd 793->794 795 a842bc-a842d3 FindResourceExW 793->795 796 a842d9 795->796 797 ac35ba-ac35c9 LoadResource 795->797 796->794 797->796 798 ac35cf-ac35dd SizeofResource 797->798 798->796 799 ac35e3-ac35ee LockResource 798->799 799->796 800 ac35f4-ac3612 799->800 800->796
                                                          APIs
                                                          • CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,00A850AA,?,?,00000000,00000000), ref: 00A842B2
                                                          • FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00A850AA,?,?,00000000,00000000), ref: 00A842C9
                                                          • LoadResource.KERNEL32(?,00000000,?,?,00A850AA,?,?,00000000,00000000,?,?,?,?,?,?,00A84F20), ref: 00AC35BE
                                                          • SizeofResource.KERNEL32(?,00000000,?,?,00A850AA,?,?,00000000,00000000,?,?,?,?,?,?,00A84F20), ref: 00AC35D3
                                                          • LockResource.KERNEL32(00A850AA,?,?,00A850AA,?,?,00000000,00000000,?,?,?,?,?,?,00A84F20,?), ref: 00AC35E6
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Resource$CreateFindGlobalLoadLockSizeofStream
                                                          • String ID: SCRIPT
                                                          • API String ID: 3051347437-3967369404
                                                          • Opcode ID: 85003a10613887bc30d01d000a1da82b790a424821b6cf3e3bfc74526d3fd07f
                                                          • Instruction ID: 0fcefbf236babf106bca2f7f340c77b995cc1ead9adf08d4614e01a0338017dd
                                                          • Opcode Fuzzy Hash: 85003a10613887bc30d01d000a1da82b790a424821b6cf3e3bfc74526d3fd07f
                                                          • Instruction Fuzzy Hash: 20117C75244705BFDB219B65DC48FA77FB9EBC9B55F208169B402D7260EB71D8008A60
                                                          Function 00AC2BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          APIs
                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 00A82B6B
                                                            • Part of subcall function 00A83A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00B51418,?,00A82E7F,?,?,?,00000000), ref: 00A83A78
                                                            • Part of subcall function 00A89CB3: _wcslen.LIBCMT ref: 00A89CBD
                                                          • GetForegroundWindow.USER32(runas,?,?,?,?,?,00B42224), ref: 00AC2C10
                                                          • ShellExecuteW.SHELL32(00000000,?,?,00B42224), ref: 00AC2C17
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
                                                          • String ID: runas
                                                          • API String ID: 448630720-4000483414
                                                          • Opcode ID: acde094dd9ac3a445ea1b35529ee2aca92c0824e3871f04c41441cde9796c78d
                                                          • Instruction ID: 77275fc940becdd42289214fbc3637cd40777a5e6ff395e1c817d7f5a335feca
                                                          • Opcode Fuzzy Hash: acde094dd9ac3a445ea1b35529ee2aca92c0824e3871f04c41441cde9796c78d
                                                          • Instruction Fuzzy Hash: 3A11E6322083016ACB15FF64DA56FBEBBE8EF91741F44186DF082571A3CF218A4AD712
                                                          Function 00B0A67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          APIs
                                                          • CreateToolhelp32Snapshot.KERNEL32 ref: 00B0A6AC
                                                          • Process32FirstW.KERNEL32(00000000,?), ref: 00B0A6BA
                                                            • Part of subcall function 00A89CB3: _wcslen.LIBCMT ref: 00A89CBD
                                                          • Process32NextW.KERNEL32(00000000,?), ref: 00B0A79C
                                                          • CloseHandle.KERNELBASE(00000000), ref: 00B0A7AB
                                                            • Part of subcall function 00A9CE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,00AC3303,?), ref: 00A9CE8A
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
                                                          • String ID:
                                                          • API String ID: 1991900642-0
                                                          • Opcode ID: 10a3e29da5ae1bce2563e0b29a255e17831756b8a23412446628a7f18873b4cf
                                                          • Instruction ID: a30ba309ec37bd2a02fdbf6a6e8c1c2587d784fffce5796201de96cceb5c06c3
                                                          • Opcode Fuzzy Hash: 10a3e29da5ae1bce2563e0b29a255e17831756b8a23412446628a7f18873b4cf
                                                          • Instruction Fuzzy Hash: D6518B71508311AFD710EF24C986E6BBBE8FF89754F00892DF589A7291EB30D904CB92
                                                          Function 00AEDBBE Relevance: 6.0, APIs: 4, Instructions: 29filestringCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 1019 aedbbe-aedbda lstrlenW 1020 aedbdc-aedbe6 GetFileAttributesW 1019->1020 1021 aedc06 1019->1021 1022 aedbe8-aedbf7 FindFirstFileW 1020->1022 1023 aedc09-aedc0d 1020->1023 1021->1023 1022->1021 1024 aedbf9-aedc04 FindClose 1022->1024 1024->1023
                                                          APIs
                                                          • lstrlenW.KERNEL32(?,00AC5222), ref: 00AEDBCE
                                                          • GetFileAttributesW.KERNELBASE(?), ref: 00AEDBDD
                                                          • FindFirstFileW.KERNEL32(?,?), ref: 00AEDBEE
                                                          • FindClose.KERNEL32(00000000), ref: 00AEDBFA
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: FileFind$AttributesCloseFirstlstrlen
                                                          • String ID:
                                                          • API String ID: 2695905019-0
                                                          • Opcode ID: ebc583692d53de2828b80a8887c1e6cae4008d62c028d13602c76f362428763b
                                                          • Instruction ID: 9f457b526094b801aab967788bd205d82f2437ab4edaf51a0ff85d90e04e75c6
                                                          • Opcode Fuzzy Hash: ebc583692d53de2828b80a8887c1e6cae4008d62c028d13602c76f362428763b
                                                          • Instruction Fuzzy Hash: 4FF0E5308509106782206F7CAC0D8EA3B7C9E81374BA08702F836C30F0EFB05D64C6D6
                                                          Function 00AA4CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          • GetCurrentProcess.KERNEL32(00AB28E9,?,00AA4CBE,00AB28E9,00B488B8,0000000C,00AA4E15,00AB28E9,00000002,00000000,?,00AB28E9), ref: 00AA4D09
                                                          • TerminateProcess.KERNEL32(00000000,?,00AA4CBE,00AB28E9,00B488B8,0000000C,00AA4E15,00AB28E9,00000002,00000000,?,00AB28E9), ref: 00AA4D10
                                                          • ExitProcess.KERNEL32 ref: 00AA4D22
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Process$CurrentExitTerminate
                                                          • String ID:
                                                          • API String ID: 1703294689-0
                                                          • Opcode ID: 5bb1b2a17f3a737aeaf9709c3e781c15dbdb48926b48b5d6991c0faa4ee85e77
                                                          • Instruction ID: 9ea91281e2ee7e79e986bade2b91d73a2fe7e39e4072a9294b2e9e5b09409ae9
                                                          • Opcode Fuzzy Hash: 5bb1b2a17f3a737aeaf9709c3e781c15dbdb48926b48b5d6991c0faa4ee85e77
                                                          • Instruction Fuzzy Hash: A9E0B631040148AFCF11AF54EE09A997F69EB86785B508014FD159B162DB75DE52CA84
                                                          Function 00B0AFF9 Relevance: 24.4, APIs: 16, Instructions: 418processCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 0 b0aff9-b0b056 call aa2340 3 b0b094-b0b098 0->3 4 b0b058-b0b06b call a8b567 0->4 5 b0b09a-b0b0bb call a8b567 * 2 3->5 6 b0b0dd-b0b0e0 3->6 15 b0b0c8 4->15 16 b0b06d-b0b092 call a8b567 * 2 4->16 30 b0b0bf-b0b0c4 5->30 10 b0b0e2-b0b0e5 6->10 11 b0b0f5-b0b119 call a87510 call a87620 6->11 12 b0b0e8-b0b0ed call a8b567 10->12 32 b0b1d8-b0b1e0 11->32 33 b0b11f-b0b178 call a87510 call a87620 call a87510 call a87620 call a87510 call a87620 11->33 12->11 20 b0b0cb-b0b0cf 15->20 16->30 25 b0b0d1-b0b0d7 20->25 26 b0b0d9-b0b0db 20->26 25->12 26->6 26->11 30->6 34 b0b0c6 30->34 35 b0b1e2-b0b1fd call a87510 call a87620 32->35 36 b0b20a-b0b238 GetCurrentDirectoryW call a9fe0b GetCurrentDirectoryW 32->36 80 b0b1a6-b0b1d6 GetSystemDirectoryW call a9fe0b GetSystemDirectoryW 33->80 81 b0b17a-b0b195 call a87510 call a87620 33->81 34->20 35->36 50 b0b1ff-b0b208 call aa4963 35->50 45 b0b23c 36->45 48 b0b240-b0b244 45->48 51 b0b275-b0b285 call af00d9 48->51 52 b0b246-b0b270 call a89c6e * 3 48->52 50->36 50->51 64 b0b287-b0b289 51->64 65 b0b28b-b0b2e1 call af07c0 call af06e6 call af05a7 51->65 52->51 68 b0b2ee-b0b2f2 64->68 65->68 100 b0b2e3 65->100 70 b0b2f8-b0b321 call ae11c8 68->70 71 b0b39a-b0b3be CreateProcessW 68->71 84 b0b323-b0b328 call ae1201 70->84 85 b0b32a call ae14ce 70->85 78 b0b3c1-b0b3d4 call a9fe14 * 2 71->78 101 b0b3d6-b0b3e8 78->101 102 b0b42f-b0b43d CloseHandle 78->102 80->45 81->80 107 b0b197-b0b1a0 call aa4963 81->107 99 b0b32f-b0b33c call aa4963 84->99 85->99 115 b0b347-b0b357 call aa4963 99->115 116 b0b33e-b0b345 99->116 100->68 105 b0b3ea 101->105 106 b0b3ed-b0b3fc 101->106 109 b0b49c 102->109 110 b0b43f-b0b444 102->110 105->106 111 b0b401-b0b42a GetLastError call a8630c call a8cfa0 106->111 112 b0b3fe 106->112 107->48 107->80 113 b0b4a0-b0b4a4 109->113 117 b0b451-b0b456 110->117 118 b0b446-b0b44c CloseHandle 110->118 129 b0b4e5-b0b4f6 call af0175 111->129 112->111 120 b0b4b2-b0b4bc 113->120 121 b0b4a6-b0b4b0 113->121 134 b0b362-b0b372 call aa4963 115->134 135 b0b359-b0b360 115->135 116->115 116->116 124 b0b463-b0b468 117->124 125 b0b458-b0b45e CloseHandle 117->125 118->117 130 b0b4c4-b0b4e3 call a8cfa0 CloseHandle 120->130 131 b0b4be 120->131 121->129 126 b0b475-b0b49a call af09d9 call b0b536 124->126 127 b0b46a-b0b470 CloseHandle 124->127 125->124 126->113 127->126 130->129 131->130 146 b0b374-b0b37b 134->146 147 b0b37d-b0b398 call a9fe14 * 3 134->147 135->134 135->135 146->146 146->147 147->78
                                                          APIs
                                                          • _wcslen.LIBCMT ref: 00B0B198
                                                          • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00B0B1B0
                                                          • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00B0B1D4
                                                          • _wcslen.LIBCMT ref: 00B0B200
                                                          • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00B0B214
                                                          • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00B0B236
                                                          • _wcslen.LIBCMT ref: 00B0B332
                                                            • Part of subcall function 00AF05A7: GetStdHandle.KERNEL32(000000F6), ref: 00AF05C6
                                                          • _wcslen.LIBCMT ref: 00B0B34B
                                                          • _wcslen.LIBCMT ref: 00B0B366
                                                          • CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00B0B3B6
                                                          • GetLastError.KERNEL32(00000000), ref: 00B0B407
                                                          • CloseHandle.KERNEL32(?), ref: 00B0B439
                                                          • CloseHandle.KERNEL32(00000000), ref: 00B0B44A
                                                          • CloseHandle.KERNEL32(00000000), ref: 00B0B45C
                                                          • CloseHandle.KERNEL32(00000000), ref: 00B0B46E
                                                          • CloseHandle.KERNEL32(?), ref: 00B0B4E3
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
                                                          • String ID:
                                                          • API String ID: 2178637699-0
                                                          • Opcode ID: f6ee22210271c750b447b19beaf690783350f04728bf3bb5ee4e7a8dcc6e8adb
                                                          • Instruction ID: 84a75d669de812250ced9dbcf58219384ea78f269fd4cb75ddc08877523f732b
                                                          • Opcode Fuzzy Hash: f6ee22210271c750b447b19beaf690783350f04728bf3bb5ee4e7a8dcc6e8adb
                                                          • Instruction Fuzzy Hash: 8DF179316082409FCB14EF24C991F6EBBE5EF85714F18859DF8969B2A2DB31EC40CB52
                                                          Function 00A8D730 Relevance: 21.6, APIs: 14, Instructions: 618windowsleeptimeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetInputState.USER32 ref: 00A8D807
                                                          • timeGetTime.WINMM ref: 00A8DA07
                                                          • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00A8DB28
                                                          • TranslateMessage.USER32(?), ref: 00A8DB7B
                                                          • DispatchMessageW.USER32(?), ref: 00A8DB89
                                                          • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00A8DB9F
                                                          • Sleep.KERNELBASE(0000000A), ref: 00A8DBB1
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
                                                          • String ID:
                                                          • API String ID: 2189390790-0
                                                          • Opcode ID: 890643970abd7c11746e7b1c53e7324004852c0682a119b7a7b60b216e69d3fe
                                                          • Instruction ID: 9285d1ac9cbe51205aec4b9fd44bb01f8637e5279b84b84cc65359ee4cfe942d
                                                          • Opcode Fuzzy Hash: 890643970abd7c11746e7b1c53e7324004852c0682a119b7a7b60b216e69d3fe
                                                          • Instruction Fuzzy Hash: 5A42B070608341EFDB28EF24C844BAABBF1BF95314F54895AE496873D1DB71E844CB92
                                                          Function 00A82CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53windowregistryCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          APIs
                                                          • GetSysColorBrush.USER32(0000000F), ref: 00A82D07
                                                          • RegisterClassExW.USER32(00000030), ref: 00A82D31
                                                          • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00A82D42
                                                          • InitCommonControlsEx.COMCTL32(?), ref: 00A82D5F
                                                          • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00A82D6F
                                                          • LoadIconW.USER32(000000A9), ref: 00A82D85
                                                          • ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00A82D94
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                                          • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                                          • API String ID: 2914291525-1005189915
                                                          • Opcode ID: 504febea6c5a04ef5edd32c8cd47d249444efe217b8ebf30bea1df15f7552814
                                                          • Instruction ID: d8e38f2812a2ba2a49bfd77f8378c0f3c9fcca840cbabab9049218e78158254c
                                                          • Opcode Fuzzy Hash: 504febea6c5a04ef5edd32c8cd47d249444efe217b8ebf30bea1df15f7552814
                                                          • Instruction Fuzzy Hash: 6D21E2B5941308AFDB01DFA8EC49BDDBFB8FB08701F00855AE511A72A0DBB14A408F94
                                                          Function 00AC065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272COMMONLIBRARYCODE
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 457 ac065b-ac068b call ac042f 460 ac068d-ac0698 call aaf2c6 457->460 461 ac06a6-ac06b2 call ab5221 457->461 466 ac069a-ac06a1 call aaf2d9 460->466 467 ac06cb-ac0714 call ac039a 461->467 468 ac06b4-ac06c9 call aaf2c6 call aaf2d9 461->468 477 ac097d-ac0983 466->477 475 ac0716-ac071f 467->475 476 ac0781-ac078a GetFileType 467->476 468->466 479 ac0756-ac077c GetLastError call aaf2a3 475->479 480 ac0721-ac0725 475->480 481 ac078c-ac07bd GetLastError call aaf2a3 CloseHandle 476->481 482 ac07d3-ac07d6 476->482 479->466 480->479 486 ac0727-ac0754 call ac039a 480->486 481->466 496 ac07c3-ac07ce call aaf2d9 481->496 484 ac07df-ac07e5 482->484 485 ac07d8-ac07dd 482->485 489 ac07e9-ac0837 call ab516a 484->489 490 ac07e7 484->490 485->489 486->476 486->479 499 ac0839-ac0845 call ac05ab 489->499 500 ac0847-ac086b call ac014d 489->500 490->489 496->466 499->500 506 ac086f-ac0879 call ab86ae 499->506 507 ac086d 500->507 508 ac087e-ac08c1 500->508 506->477 507->506 509 ac08e2-ac08f0 508->509 510 ac08c3-ac08c7 508->510 513 ac097b 509->513 514 ac08f6-ac08fa 509->514 510->509 512 ac08c9-ac08dd 510->512 512->509 513->477 514->513 516 ac08fc-ac092f CloseHandle call ac039a 514->516 519 ac0931-ac095d GetLastError call aaf2a3 call ab5333 516->519 520 ac0963-ac0977 516->520 519->520 520->513
                                                          APIs
                                                            • Part of subcall function 00AC039A: CreateFileW.KERNELBASE(00000000,00000000,?,00AC0704,?,?,00000000,?,00AC0704,00000000,0000000C), ref: 00AC03B7
                                                          • GetLastError.KERNEL32 ref: 00AC076F
                                                          • __dosmaperr.LIBCMT ref: 00AC0776
                                                          • GetFileType.KERNELBASE(00000000), ref: 00AC0782
                                                          • GetLastError.KERNEL32 ref: 00AC078C
                                                          • __dosmaperr.LIBCMT ref: 00AC0795
                                                          • CloseHandle.KERNEL32(00000000), ref: 00AC07B5
                                                          • CloseHandle.KERNEL32(?), ref: 00AC08FF
                                                          • GetLastError.KERNEL32 ref: 00AC0931
                                                          • __dosmaperr.LIBCMT ref: 00AC0938
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
                                                          • String ID: H
                                                          • API String ID: 4237864984-2852464175
                                                          • Opcode ID: 44da0d9f7eb6bddf88f4bd1263be9cf9bee0ff5170a668ded8b81303be7eb903
                                                          • Instruction ID: 6e6d6cee9604562667a8f03f2b8962965b9ab54e18f9f9ebf7e6893b9190babe
                                                          • Opcode Fuzzy Hash: 44da0d9f7eb6bddf88f4bd1263be9cf9bee0ff5170a668ded8b81303be7eb903
                                                          • Instruction Fuzzy Hash: 4CA11332A14608CFDF19AF68D851FAE7BA0AB0A320F15415DF815AF3D2DB359D12CB91
                                                          Function 00A8344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201registryCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          APIs
                                                            • Part of subcall function 00A83A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00B51418,?,00A82E7F,?,?,?,00000000), ref: 00A83A78
                                                            • Part of subcall function 00A83357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00A83379
                                                          • RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00A8356A
                                                          • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00AC318D
                                                          • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00AC31CE
                                                          • RegCloseKey.ADVAPI32(?), ref: 00AC3210
                                                          • _wcslen.LIBCMT ref: 00AC3277
                                                          • _wcslen.LIBCMT ref: 00AC3286
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
                                                          • String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
                                                          • API String ID: 98802146-2727554177
                                                          • Opcode ID: cc0c802768701c5d65345e827cc0ca57c7ffb359a9dec6f15e0afc8dffc8ce15
                                                          • Instruction ID: 4171e989bc7f7dde88da8843430b5b2870a5c10daa931c9bf056b65294f3a303
                                                          • Opcode Fuzzy Hash: cc0c802768701c5d65345e827cc0ca57c7ffb359a9dec6f15e0afc8dffc8ce15
                                                          • Instruction Fuzzy Hash: CF71C0724093019ED704EF65DD82EABBBE8FF9A740F80446EF545931B0EB309A48CB56
                                                          Function 00A82B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63windowregistryCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          APIs
                                                          • GetSysColorBrush.USER32(0000000F), ref: 00A82B8E
                                                          • LoadCursorW.USER32(00000000,00007F00), ref: 00A82B9D
                                                          • LoadIconW.USER32(00000063), ref: 00A82BB3
                                                          • LoadIconW.USER32(000000A4), ref: 00A82BC5
                                                          • LoadIconW.USER32(000000A2), ref: 00A82BD7
                                                          • LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00A82BEF
                                                          • RegisterClassExW.USER32(?), ref: 00A82C40
                                                            • Part of subcall function 00A82CD4: GetSysColorBrush.USER32(0000000F), ref: 00A82D07
                                                            • Part of subcall function 00A82CD4: RegisterClassExW.USER32(00000030), ref: 00A82D31
                                                            • Part of subcall function 00A82CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00A82D42
                                                            • Part of subcall function 00A82CD4: InitCommonControlsEx.COMCTL32(?), ref: 00A82D5F
                                                            • Part of subcall function 00A82CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00A82D6F
                                                            • Part of subcall function 00A82CD4: LoadIconW.USER32(000000A9), ref: 00A82D85
                                                            • Part of subcall function 00A82CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00A82D94
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
                                                          • String ID: #$0$AutoIt v3
                                                          • API String ID: 423443420-4155596026
                                                          • Opcode ID: d7f64807fe60971398ed0aba6b74f68be2dc469206431c2d37ca88c87158b472
                                                          • Instruction ID: 54526442a090729edbbcc61b396d3b91548e50ad8275af774ee989adf1f81d2f
                                                          • Opcode Fuzzy Hash: d7f64807fe60971398ed0aba6b74f68be2dc469206431c2d37ca88c87158b472
                                                          • Instruction Fuzzy Hash: C4212C75E40314BBDB10DFA9EC65BA97FB4FB48B51F00459AE500A76A0DBB14940CF98
                                                          Function 00A83170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145windowtimeregistryCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 598 a83170-a83185 599 a831e5-a831e7 598->599 600 a83187-a8318a 598->600 599->600 603 a831e9 599->603 601 a831eb 600->601 602 a8318c-a83193 600->602 607 ac2dfb-ac2e23 call a818e2 call a9e499 601->607 608 a831f1-a831f6 601->608 604 a83199-a8319e 602->604 605 a83265-a8326d PostQuitMessage 602->605 606 a831d0-a831d8 DefWindowProcW 603->606 610 ac2e7c-ac2e90 call aebf30 604->610 611 a831a4-a831a8 604->611 613 a83219-a8321b 605->613 612 a831de-a831e4 606->612 642 ac2e28-ac2e2f 607->642 614 a831f8-a831fb 608->614 615 a8321d-a83244 SetTimer RegisterWindowMessageW 608->615 610->613 636 ac2e96 610->636 617 ac2e68-ac2e72 call aec161 611->617 618 a831ae-a831b3 611->618 613->612 621 ac2d9c-ac2d9f 614->621 622 a83201-a8320f KillTimer call a830f2 614->622 615->613 619 a83246-a83251 CreatePopupMenu 615->619 632 ac2e77 617->632 625 ac2e4d-ac2e54 618->625 626 a831b9-a831be 618->626 619->613 628 ac2dd7-ac2df6 MoveWindow 621->628 629 ac2da1-ac2da5 621->629 631 a83214 call a83c50 622->631 625->606 639 ac2e5a-ac2e63 call ae0ad7 625->639 634 a83253-a83263 call a8326f 626->634 635 a831c4-a831ca 626->635 628->613 637 ac2dc6-ac2dd2 SetFocus 629->637 638 ac2da7-ac2daa 629->638 631->613 632->613 634->613 635->606 635->642 636->606 637->613 638->635 643 ac2db0-ac2dc1 call a818e2 638->643 639->606 642->606 647 ac2e35-ac2e48 call a830f2 call a83837 642->647 643->613 647->606
                                                          APIs
                                                          • DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,00A8316A,?,?), ref: 00A831D8
                                                          • KillTimer.USER32(?,00000001,?,?,?,?,?,00A8316A,?,?), ref: 00A83204
                                                          • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00A83227
                                                          • RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,00A8316A,?,?), ref: 00A83232
                                                          • CreatePopupMenu.USER32 ref: 00A83246
                                                          • PostQuitMessage.USER32(00000000), ref: 00A83267
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
                                                          • String ID: TaskbarCreated
                                                          • API String ID: 129472671-2362178303
                                                          • Opcode ID: 33c18494d445df9e494200de268b79de4644cb3adba58965af3a9432c1f5a6d0
                                                          • Instruction ID: 9b0149b6478a09dd753a8d20c413d155d5059194fc730feed1608fcc10f2b3bf
                                                          • Opcode Fuzzy Hash: 33c18494d445df9e494200de268b79de4644cb3adba58965af3a9432c1f5a6d0
                                                          • Instruction Fuzzy Hash: 6E412533240204AADF157F7C9D1DBBD3E69EB15F01F0446A9FA02872E1EFA19E418B61
                                                          Function 00A81410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 654 a81410-a81449 655 ac24b8-ac24b9 DestroyWindow 654->655 656 a8144f-a81465 mciSendStringW 654->656 660 ac24c4-ac24d1 655->660 657 a8146b-a81473 656->657 658 a816c6-a816d3 656->658 659 a81479-a81488 call a8182e 657->659 657->660 661 a816f8-a816ff 658->661 662 a816d5-a816f0 UnregisterHotKey 658->662 674 ac250e-ac251a 659->674 675 a8148e-a81496 659->675 666 ac2500-ac2507 660->666 667 ac24d3-ac24d6 660->667 661->657 665 a81705 661->665 662->661 664 a816f2-a816f3 call a810d0 662->664 664->661 665->658 666->660 670 ac2509 666->670 671 ac24d8-ac24e0 call a86246 667->671 672 ac24e2-ac24e5 FindClose 667->672 670->674 676 ac24eb-ac24f8 671->676 672->676 681 ac251c-ac251e FreeLibrary 674->681 682 ac2524-ac252b 674->682 678 a8149c-a814c1 call a8cfa0 675->678 679 ac2532-ac253f 675->679 676->666 680 ac24fa-ac24fb call af32b1 676->680 692 a814f8-a81503 CoUninitialize 678->692 693 a814c3 678->693 686 ac2566-ac256d 679->686 687 ac2541-ac255e VirtualFree 679->687 680->666 681->682 682->674 685 ac252d 682->685 685->679 686->679 689 ac256f 686->689 687->686 688 ac2560-ac2561 call af3317 687->688 688->686 694 ac2574-ac2578 689->694 692->694 696 a81509-a8150e 692->696 695 a814c6-a814f6 call a81a05 call a819ae 693->695 694->696 697 ac257e-ac2584 694->697 695->692 699 ac2589-ac2596 call af32eb 696->699 700 a81514-a8151e 696->700 697->696 713 ac2598 699->713 701 a81524-a815a5 call a8988f call a81944 call a817d5 call a9fe14 call a8177c call a8988f call a8cfa0 call a817fe call a9fe14 700->701 702 a81707-a81714 call a9f80e 700->702 717 ac259d-ac25bf call a9fdcd 701->717 743 a815ab-a815cf call a9fe14 701->743 702->701 715 a8171a 702->715 713->717 715->702 722 ac25c1 717->722 725 ac25c6-ac25e8 call a9fdcd 722->725 731 ac25ea 725->731 734 ac25ef-ac2611 call a9fdcd 731->734 741 ac2613 734->741 744 ac2618-ac2625 call ae64d4 741->744 743->725 750 a815d5-a815f9 call a9fe14 743->750 749 ac2627 744->749 752 ac262c-ac2639 call a9ac64 749->752 750->734 755 a815ff-a81619 call a9fe14 750->755 758 ac263b 752->758 755->744 760 a8161f-a81643 call a817d5 call a9fe14 755->760 761 ac2640-ac264d call af3245 758->761 760->752 769 a81649-a81651 760->769 768 ac264f 761->768 771 ac2654-ac2661 call af32cc 768->771 769->761 770 a81657-a81675 call a8988f call a8190a 769->770 770->771 780 a8167b-a81689 770->780 777 ac2663 771->777 779 ac2668-ac2675 call af32cc 777->779 785 ac2677 779->785 780->779 782 a8168f-a816c5 call a8988f * 3 call a81876 780->782 785->785
                                                          APIs
                                                          • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00A81459
                                                          • CoUninitialize.COMBASE ref: 00A814F8
                                                          • UnregisterHotKey.USER32(?), ref: 00A816DD
                                                          • DestroyWindow.USER32(?), ref: 00AC24B9
                                                          • FreeLibrary.KERNEL32(?), ref: 00AC251E
                                                          • VirtualFree.KERNEL32(?,00000000,00008000), ref: 00AC254B
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
                                                          • String ID: close all
                                                          • API String ID: 469580280-3243417748
                                                          • Opcode ID: 593a195a3d20d6b21ca1551737bf371e3edd437c4265033e1de230956af78058
                                                          • Instruction ID: 42f2b75d863bb9aefb37cdfdd6617b3fd0d6a239fd7d1a5c799e6a494b5c37f7
                                                          • Opcode Fuzzy Hash: 593a195a3d20d6b21ca1551737bf371e3edd437c4265033e1de230956af78058
                                                          • Instruction Fuzzy Hash: 5AD147317012128FDB29EF15CA99F69F7A4BF05700F2542ADE44AAB261DB30AD13CF91
                                                          Function 00A82C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 803 a82c63-a82cd3 CreateWindowExW * 2 ShowWindow * 2
                                                          APIs
                                                          • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00A82C91
                                                          • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00A82CB2
                                                          • ShowWindow.USER32(00000000,?,?,?,?,?,?,00A81CAD,?), ref: 00A82CC6
                                                          • ShowWindow.USER32(00000000,?,?,?,?,?,?,00A81CAD,?), ref: 00A82CCF
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Window$CreateShow
                                                          • String ID: AutoIt v3$edit
                                                          • API String ID: 1584632944-3779509399
                                                          • Opcode ID: bf50a22d434c1d8f88b70657125570ebf30489f6c666d950fcd335ac5d8bb63f
                                                          • Instruction ID: 8528698cb382afb30aa0f3d6e6dbde41c8832322707d82442e96f1870251e032
                                                          • Opcode Fuzzy Hash: bf50a22d434c1d8f88b70657125570ebf30489f6c666d950fcd335ac5d8bb63f
                                                          • Instruction Fuzzy Hash: 68F03A755803907AEB310B1BAC18FB72EBDD7C6F61F01449AF900A31B0CA610840DAB8
                                                          Function 00A83B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58registryCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 954 a83b1c-a83b27 955 a83b99-a83b9b 954->955 956 a83b29-a83b2e 954->956 957 a83b8c-a83b8f 955->957 956->955 958 a83b30-a83b48 RegOpenKeyExW 956->958 958->955 959 a83b4a-a83b69 RegQueryValueExW 958->959 960 a83b6b-a83b76 959->960 961 a83b80-a83b8b RegCloseKey 959->961 962 a83b78-a83b7a 960->962 963 a83b90-a83b97 960->963 961->957 964 a83b7e 962->964 963->964 964->961
                                                          APIs
                                                          • RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00A83B0F,SwapMouseButtons,00000004,?), ref: 00A83B40
                                                          • RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00A83B0F,SwapMouseButtons,00000004,?), ref: 00A83B61
                                                          • RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,00A83B0F,SwapMouseButtons,00000004,?), ref: 00A83B83
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: CloseOpenQueryValue
                                                          • String ID: Control Panel\Mouse
                                                          • API String ID: 3677997916-824357125
                                                          • Opcode ID: 148d19427e73264f1114dbdda428912a4c5d2e0bfb974549c12ca7f7d289ec99
                                                          • Instruction ID: 361b2ea40ddbd2c0bdd26b0bea4f9cfc8d8bbc5217ac4b3ea8ac4c131837ca48
                                                          • Opcode Fuzzy Hash: 148d19427e73264f1114dbdda428912a4c5d2e0bfb974549c12ca7f7d289ec99
                                                          • Instruction Fuzzy Hash: AE112AB6510208FFDF21DFA5DC48AEEBBB8EF04B84B108459A806D7110E6719F409760
                                                          Function 00A83923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00AC33A2
                                                            • Part of subcall function 00A86B57: _wcslen.LIBCMT ref: 00A86B6A
                                                          • Shell_NotifyIconW.SHELL32(00000001,?), ref: 00A83A04
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: IconLoadNotifyShell_String_wcslen
                                                          • String ID: Line:
                                                          • API String ID: 2289894680-1585850449
                                                          • Opcode ID: d043f14bb0d7be4e81a1cebde926df53bce52c2d425dff2c99b1ecb1f06e92c7
                                                          • Instruction ID: 1d9184d3b820dbe5e820ba810f4b5c3302222c4d65204b057a2426f1375e4262
                                                          • Opcode Fuzzy Hash: d043f14bb0d7be4e81a1cebde926df53bce52c2d425dff2c99b1ecb1f06e92c7
                                                          • Instruction Fuzzy Hash: 5D31CF72408300AADB25FB24DC55BEBB7E8AB40B10F00496EF59A97191EF709A49C7C6
                                                          Function 00A9FDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 00AA0668
                                                            • Part of subcall function 00AA32A4: RaiseException.KERNEL32(?,?,?,00AA068A,?,00B51444,?,?,?,?,?,?,00AA068A,00A81129,00B48738,00A81129), ref: 00AA3304
                                                          • __CxxThrowException@8.LIBVCRUNTIME ref: 00AA0685
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Exception@8Throw$ExceptionRaise
                                                          • String ID: Unknown exception
                                                          • API String ID: 3476068407-410509341
                                                          • Opcode ID: 93edff4ff68ed023ac4d40cc470c8119a5dfb0171573453d8d2dd44b848fca07
                                                          • Instruction ID: 6c6003fee8d07ef2c1664903574ff9d568f2106e6c024a855b707f42aacf11cf
                                                          • Opcode Fuzzy Hash: 93edff4ff68ed023ac4d40cc470c8119a5dfb0171573453d8d2dd44b848fca07
                                                          • Instruction Fuzzy Hash: 56F0C234A0020D7B8F00B7A4D946DAE77AC5E42358B604171B814D75E1EFB1EB69C5C0
                                                          Function 00A810F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00A81BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00A81BF4
                                                            • Part of subcall function 00A81BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 00A81BFC
                                                            • Part of subcall function 00A81BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00A81C07
                                                            • Part of subcall function 00A81BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00A81C12
                                                            • Part of subcall function 00A81BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 00A81C1A
                                                            • Part of subcall function 00A81BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 00A81C22
                                                            • Part of subcall function 00A81B4A: RegisterWindowMessageW.USER32(00000004,?,00A812C4), ref: 00A81BA2
                                                          • GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00A8136A
                                                          • OleInitialize.OLE32 ref: 00A81388
                                                          • CloseHandle.KERNEL32(00000000,00000000), ref: 00AC24AB
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
                                                          • String ID:
                                                          • API String ID: 1986988660-0
                                                          • Opcode ID: a4137cd03fefac0c8f3cbd276562f7e815aa6cb6189caf7d701ebf479c50db77
                                                          • Instruction ID: 0c6c20a70c9c906960dedff233462016d040db3903a9d540716ea9b5d35e0570
                                                          • Opcode Fuzzy Hash: a4137cd03fefac0c8f3cbd276562f7e815aa6cb6189caf7d701ebf479c50db77
                                                          • Instruction Fuzzy Hash: 9C71B6B59023008ED785EF7DBA457A53AE4BBA83867548EEAD41AC7361FF304885CF50
                                                          Function 00AEC161 Relevance: 4.6, APIs: 3, Instructions: 74timewindowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00A83923: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00A83A04
                                                          • Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00AEC259
                                                          • KillTimer.USER32(?,00000001,?,?), ref: 00AEC261
                                                          • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00AEC270
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: IconNotifyShell_Timer$Kill
                                                          • String ID:
                                                          • API String ID: 3500052701-0
                                                          • Opcode ID: de86bf545dfab11a608d1b97e1cea2f833eb61513923be0e1f050f0ff208a1b3
                                                          • Instruction ID: ce7f237684f6463f448543216748aec29aa9c1d8523436476f6d771ece699384
                                                          • Opcode Fuzzy Hash: de86bf545dfab11a608d1b97e1cea2f833eb61513923be0e1f050f0ff208a1b3
                                                          • Instruction Fuzzy Hash: 3031D570904384AFEB32AF758855BEBBBFC9F06314F00449EE2DA97241C7745A86CB51
                                                          Function 00AB86AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          • CloseHandle.KERNELBASE(00000000,00000000,?,?,00AB85CC,?,00B48CC8,0000000C), ref: 00AB8704
                                                          • GetLastError.KERNEL32(?,00AB85CC,?,00B48CC8,0000000C), ref: 00AB870E
                                                          • __dosmaperr.LIBCMT ref: 00AB8739
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: CloseErrorHandleLast__dosmaperr
                                                          • String ID:
                                                          • API String ID: 2583163307-0
                                                          • Opcode ID: 299b072e0650dbac25d41e5f2659b23fbe58cf6c4931d76a04147778d4b27163
                                                          • Instruction ID: b62a99bbf24d58527a8fe573d6f09779fcaad0f927a05f5d1d45a97ae0688036
                                                          • Opcode Fuzzy Hash: 299b072e0650dbac25d41e5f2659b23fbe58cf6c4931d76a04147778d4b27163
                                                          • Instruction Fuzzy Hash: 6A014E32A0572026D664733CA9557FE6B9D4B92778F390159F8148F1D3DEB8CC81D150
                                                          Function 00A8DB38 Relevance: 4.5, APIs: 3, Instructions: 29windowsleepCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • TranslateMessage.USER32(?), ref: 00A8DB7B
                                                          • DispatchMessageW.USER32(?), ref: 00A8DB89
                                                          • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00A8DB9F
                                                          • Sleep.KERNELBASE(0000000A), ref: 00A8DBB1
                                                          • TranslateAcceleratorW.USER32(?,?,?), ref: 00AD1CC9
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Message$Translate$AcceleratorDispatchPeekSleep
                                                          • String ID:
                                                          • API String ID: 3288985973-0
                                                          • Opcode ID: 532381368b20759fbc6d05a6ec66bc7410ac4042e9b18cb7237c19efa933bfb5
                                                          • Instruction ID: 2d122ac9e5dd2bba04406a4d8872e69f75ce5623849c35a9d8c58cdbb2af5f10
                                                          • Opcode Fuzzy Hash: 532381368b20759fbc6d05a6ec66bc7410ac4042e9b18cb7237c19efa933bfb5
                                                          • Instruction Fuzzy Hash: 7BF05E306443409BEB30DB608C49FEA77A9EB45311F508919E65A830C0DF7098488B25
                                                          Function 00A91310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • __Init_thread_footer.LIBCMT ref: 00A917F6
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Init_thread_footer
                                                          • String ID: CALL
                                                          • API String ID: 1385522511-4196123274
                                                          • Opcode ID: dd4f2387a0c9f1ce16071171fa6fa5d86e4f73d57170a840802c653863cffacb
                                                          • Instruction ID: 4debb884a98a4e51ae94e70994ae7b005391f74b850ff663eeddb282c6023a84
                                                          • Opcode Fuzzy Hash: dd4f2387a0c9f1ce16071171fa6fa5d86e4f73d57170a840802c653863cffacb
                                                          • Instruction Fuzzy Hash: 6C228BB46083029FCB14DF14C584B2ABBF1BF89314F29895DF5968B3A2D731E945CB92
                                                          Function 00A82DE3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetOpenFileNameW.COMDLG32(?), ref: 00AC2C8C
                                                            • Part of subcall function 00A83AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00A83A97,?,?,00A82E7F,?,?,?,00000000), ref: 00A83AC2
                                                            • Part of subcall function 00A82DA5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00A82DC4
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Name$Path$FileFullLongOpen
                                                          • String ID: X
                                                          • API String ID: 779396738-3081909835
                                                          • Opcode ID: 1fc35abb5930b04289a46070919c3417fec31fcc686c8c2664dceb735db7c33b
                                                          • Instruction ID: 58a730e53c2986fa6dacd10e5caa5d173b8820fdceba1fdf916e44cbb634ab3f
                                                          • Opcode Fuzzy Hash: 1fc35abb5930b04289a46070919c3417fec31fcc686c8c2664dceb735db7c33b
                                                          • Instruction Fuzzy Hash: F021B771A002589FDF01EF94C949BEE7BFCAF49715F008059E405B7241DBB45A898FA1
                                                          Function 00A83837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • Shell_NotifyIconW.SHELL32(00000000,?), ref: 00A83908
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: IconNotifyShell_
                                                          • String ID:
                                                          • API String ID: 1144537725-0
                                                          • Opcode ID: 5f51b6139bddc1288164ebce9e8d5268362626f8cfd22a46c5f1e999caa8f299
                                                          • Instruction ID: d3945723bd1b4a6c517635ae33e366bb7befa1b8834c6eb82645ef614a0ee4bb
                                                          • Opcode Fuzzy Hash: 5f51b6139bddc1288164ebce9e8d5268362626f8cfd22a46c5f1e999caa8f299
                                                          • Instruction Fuzzy Hash: DE3193715043019FDB20EF24D894797BBE4FB49709F00096EF59987250EB71AA44CB52
                                                          Function 00A9F645 Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • timeGetTime.WINMM ref: 00A9F661
                                                            • Part of subcall function 00A8D730: GetInputState.USER32 ref: 00A8D807
                                                          • Sleep.KERNEL32(00000000), ref: 00ADF2DE
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: InputSleepStateTimetime
                                                          • String ID:
                                                          • API String ID: 4149333218-0
                                                          • Opcode ID: 1252358bc7003941cf336eab2a456d0f6e38ebdde1d2ad200ff403fd39da929f
                                                          • Instruction ID: 25ab10f43cad830e668693b51d421d2dc2a17f265661ef3880d331c36ea51415
                                                          • Opcode Fuzzy Hash: 1252358bc7003941cf336eab2a456d0f6e38ebdde1d2ad200ff403fd39da929f
                                                          • Instruction Fuzzy Hash: 7BF082712803059FD314FF65D545B9ABBE4EF45760F004029E85AC73A1DB70A800CB90
                                                          Function 00A8B710 Relevance: 2.1, APIs: 1, Instructions: 587COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • __Init_thread_footer.LIBCMT ref: 00A8BB4E
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Init_thread_footer
                                                          • String ID:
                                                          • API String ID: 1385522511-0
                                                          • Opcode ID: 85f7d678ea5678c9868280b80a993fc580baeb6a71313f14d573fb1485649781
                                                          • Instruction ID: 67d1596d4480087d191de2c349764e16a96255bdd43d0a00e6f755b58ba38a9a
                                                          • Opcode Fuzzy Hash: 85f7d678ea5678c9868280b80a993fc580baeb6a71313f14d573fb1485649781
                                                          • Instruction Fuzzy Hash: F832AB34A002099FDB24EF54C894FBEB7B9EF45340F18809AE916AB361D774ED41CBA1
                                                          Function 00A84ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00A84E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00A84EDD,?,00B51418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00A84E9C
                                                            • Part of subcall function 00A84E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00A84EAE
                                                            • Part of subcall function 00A84E90: FreeLibrary.KERNEL32(00000000,?,?,00A84EDD,?,00B51418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00A84EC0
                                                          • LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00B51418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00A84EFD
                                                            • Part of subcall function 00A84E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00AC3CDE,?,00B51418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00A84E62
                                                            • Part of subcall function 00A84E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00A84E74
                                                            • Part of subcall function 00A84E59: FreeLibrary.KERNEL32(00000000,?,?,00AC3CDE,?,00B51418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00A84E87
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Library$Load$AddressFreeProc
                                                          • String ID:
                                                          • API String ID: 2632591731-0
                                                          • Opcode ID: f936b5ab68e8235e9745e8c89b56583751af2a5be0fcc924dc47e68579162d5c
                                                          • Instruction ID: 5a8df62306b267249aa0ab9d9c43d4dfddee8159d0fe6ccf55c420d43da0ca0c
                                                          • Opcode Fuzzy Hash: f936b5ab68e8235e9745e8c89b56583751af2a5be0fcc924dc47e68579162d5c
                                                          • Instruction Fuzzy Hash: 8B11E332600206AACF14FF70DE02FED77A5AF48B14F20842EF642A61D1EE709E459B90
                                                          Function 00AB8402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: __wsopen_s
                                                          • String ID:
                                                          • API String ID: 3347428461-0
                                                          • Opcode ID: cb9d16bfaefe56ca91b4ce430b0448bf34a4900a5faadc3b1034f3fe3c0e7357
                                                          • Instruction ID: 2c065155f934ae03b318901469a2de5f674d7456fcb1080a86ed429e3a6202e1
                                                          • Opcode Fuzzy Hash: cb9d16bfaefe56ca91b4ce430b0448bf34a4900a5faadc3b1034f3fe3c0e7357
                                                          • Instruction Fuzzy Hash: 9B11187590420AAFCF05DF58E941ADA7BF9EF48314F114199FC08AB312DA31DA11CBA5
                                                          Function 00B129BF Relevance: 1.5, APIs: 1, Instructions: 48COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetForegroundWindow.USER32(00000000,?,?,?,00B114B5,?), ref: 00B12A01
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: ForegroundWindow
                                                          • String ID:
                                                          • API String ID: 2020703349-0
                                                          • Opcode ID: 1203ff758a2badfeb36dd41635d1bf5c760bae75d7f83d4c70129d931961ae8f
                                                          • Instruction ID: 67aa28cc21d77dd34d6e614707fad01c9280eb3fe801809fc021c91efc2c38d5
                                                          • Opcode Fuzzy Hash: 1203ff758a2badfeb36dd41635d1bf5c760bae75d7f83d4c70129d931961ae8f
                                                          • Instruction Fuzzy Hash: EF019E36350A419FD3258B6CC494BA23BD2EF85354FA984A8C0478B251DB32EC92C7A0
                                                          Function 00AAE602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
                                                          • Instruction ID: 5c720be89bbabe7fa1cdbdf1bbe034fe030e169de2f175af08e4c741acb0de7d
                                                          • Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
                                                          • Instruction Fuzzy Hash: 3DF0F432511A10AAD6317B698E05B9A739C9F53330F100F1AF425931D3DB74D80586A5
                                                          Function 00AB3820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          • RtlAllocateHeap.NTDLL(00000000,?,00B51444,?,00A9FDF5,?,?,00A8A976,00000010,00B51440,00A813FC,?,00A813C6,?,00A81129), ref: 00AB3852
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: AllocateHeap
                                                          • String ID:
                                                          • API String ID: 1279760036-0
                                                          • Opcode ID: 0aec889a6b9f3c72acd47269aaa1ab68b9e5b3ae521b2c47b0c8e5569108ff6c
                                                          • Instruction ID: 3fce964ddd8493587830abb293876afe77533f575295570838016d861941c32e
                                                          • Opcode Fuzzy Hash: 0aec889a6b9f3c72acd47269aaa1ab68b9e5b3ae521b2c47b0c8e5569108ff6c
                                                          • Instruction Fuzzy Hash: AEE0A0331423246ADE212BFA9D00BDA365CAB827B0F160021BC04934D2DB509D0181E2
                                                          Function 00A84F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • FreeLibrary.KERNEL32(?,?,00B51418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00A84F6D
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: FreeLibrary
                                                          • String ID:
                                                          • API String ID: 3664257935-0
                                                          • Opcode ID: 9c96fc223ef94cc3b11c5fb8a728f0f37be2fc7ae0e447c01174fcda7ceb6ea0
                                                          • Instruction ID: 0ca0cee64526943acd640547917ef84d0493d2687fead791ffe23d9f852ed2fa
                                                          • Opcode Fuzzy Hash: 9c96fc223ef94cc3b11c5fb8a728f0f37be2fc7ae0e447c01174fcda7ceb6ea0
                                                          • Instruction Fuzzy Hash: 58F03971105752CFDB34AF64D590822BBF4BF187293258A7EE2EA83621CB319C44DF10
                                                          Function 00B12A55 Relevance: 1.5, APIs: 1, Instructions: 25COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • IsWindow.USER32(00000000), ref: 00B12A66
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Window
                                                          • String ID:
                                                          • API String ID: 2353593579-0
                                                          • Opcode ID: 02e25c0b6ad95ae7cafde8bcd6894ed507e6e6b1cf8d69f1dad70af69c22664f
                                                          • Instruction ID: 743c129c650ea516b4bbc2e4c7f69103f9dea92e33dd7f6cae489d60006be3c5
                                                          • Opcode Fuzzy Hash: 02e25c0b6ad95ae7cafde8bcd6894ed507e6e6b1cf8d69f1dad70af69c22664f
                                                          • Instruction Fuzzy Hash: 4CE04F363A011AAACB14EB31DCC48FA779CEF55395750457ABC16C3100DB30A9A586A0
                                                          Function 00A830F2 Relevance: 1.5, APIs: 1, Instructions: 24windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • Shell_NotifyIconW.SHELL32(00000002,?), ref: 00A8314E
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: IconNotifyShell_
                                                          • String ID:
                                                          • API String ID: 1144537725-0
                                                          • Opcode ID: 3a8c518591d812c2fe3cfb3f74b9f7a48e7d5087baba076fa8f6f3e5d41240d3
                                                          • Instruction ID: fc0d8fa4b39032ca15a5b506a5978329eea1e987c8e48436dda56af65649558c
                                                          • Opcode Fuzzy Hash: 3a8c518591d812c2fe3cfb3f74b9f7a48e7d5087baba076fa8f6f3e5d41240d3
                                                          • Instruction Fuzzy Hash: D5F03070914318AFEB529B28DC4A7DA7BBCAB01708F0005E9A68897292DB745B89CF55
                                                          Function 00A82DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00A82DC4
                                                            • Part of subcall function 00A86B57: _wcslen.LIBCMT ref: 00A86B6A
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: LongNamePath_wcslen
                                                          • String ID:
                                                          • API String ID: 541455249-0
                                                          • Opcode ID: ea94aa46a1f3da6d77362688306c5342cfe30d907f9202d6fb3661b0534c8ecc
                                                          • Instruction ID: dc883996c23a11785ed340b6d548cef69ecc23eeec340073b971e92afbb7fd81
                                                          • Opcode Fuzzy Hash: ea94aa46a1f3da6d77362688306c5342cfe30d907f9202d6fb3661b0534c8ecc
                                                          • Instruction Fuzzy Hash: 2EE0C272A002245BCB20A6989C0AFEA77EDDFC8794F0540B6FD09E7248DA70ED808690
                                                          Function 00A82B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00A83837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00A83908
                                                            • Part of subcall function 00A8D730: GetInputState.USER32 ref: 00A8D807
                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 00A82B6B
                                                            • Part of subcall function 00A830F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 00A8314E
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: IconNotifyShell_$CurrentDirectoryInputState
                                                          • String ID:
                                                          • API String ID: 3667716007-0
                                                          • Opcode ID: 1965a6841f35da200d937a17d9fcf6a2b4bb73988a08b83b65120c3855cc7259
                                                          • Instruction ID: ee4ed1403ae1cbdda77576167731a2d719a7774724a9e0a37059b7efbeec7c09
                                                          • Opcode Fuzzy Hash: 1965a6841f35da200d937a17d9fcf6a2b4bb73988a08b83b65120c3855cc7259
                                                          • Instruction Fuzzy Hash: B2E0863370424406CE04BB74AA566BDA7599BD1756F40197EF542472A2CE2449494752
                                                          Function 00AC039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          • CreateFileW.KERNELBASE(00000000,00000000,?,00AC0704,?,?,00000000,?,00AC0704,00000000,0000000C), ref: 00AC03B7
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: CreateFile
                                                          • String ID:
                                                          • API String ID: 823142352-0
                                                          • Opcode ID: b776737d84c988da700726b8a564ee3827695a029b094eb2d6f945b055fef015
                                                          • Instruction ID: b8d9eef3d3a76fbbd67537f88c4555b729ddf64e3224afe741e551ec1f067939
                                                          • Opcode Fuzzy Hash: b776737d84c988da700726b8a564ee3827695a029b094eb2d6f945b055fef015
                                                          • Instruction Fuzzy Hash: FFD06C3208010DBBDF028F84DD06EDA3FAAFB48714F018000BE18A6020C732E831AB90
                                                          Function 00A81CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 00A81CBC
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: InfoParametersSystem
                                                          • String ID:
                                                          • API String ID: 3098949447-0
                                                          • Opcode ID: 4f2b0f2ea3f7cef68d2ae65e25af08b6b3f84da139c69aeafe108f947fabd59c
                                                          • Instruction ID: 896f58e01bf12f7d65285ee406927c5d629dfadd85666f3ef4bce10debaf113c
                                                          • Opcode Fuzzy Hash: 4f2b0f2ea3f7cef68d2ae65e25af08b6b3f84da139c69aeafe108f947fabd59c
                                                          • Instruction Fuzzy Hash: 79C092362C1304AFF2158B84BC5BF507B65A368B02F448841FA09AB5F3DBA22820EA54

                                                          Non-executed Functions

                                                          Function 00B19576 Relevance: 72.4, APIs: 39, Strings: 2, Instructions: 625windowkeyboardCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00A99BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00A99BB2
                                                          • DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00B1961A
                                                          • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00B1965B
                                                          • GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 00B1969F
                                                          • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00B196C9
                                                          • SendMessageW.USER32 ref: 00B196F2
                                                          • GetKeyState.USER32(00000011), ref: 00B1978B
                                                          • GetKeyState.USER32(00000009), ref: 00B19798
                                                          • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00B197AE
                                                          • GetKeyState.USER32(00000010), ref: 00B197B8
                                                          • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00B197E9
                                                          • SendMessageW.USER32 ref: 00B19810
                                                          • SendMessageW.USER32(?,00001030,?,00B17E95), ref: 00B19918
                                                          • ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00B1992E
                                                          • ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00B19941
                                                          • SetCapture.USER32(?), ref: 00B1994A
                                                          • ClientToScreen.USER32(?,?), ref: 00B199AF
                                                          • ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00B199BC
                                                          • InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00B199D6
                                                          • ReleaseCapture.USER32 ref: 00B199E1
                                                          • GetCursorPos.USER32(?), ref: 00B19A19
                                                          • ScreenToClient.USER32(?,?), ref: 00B19A26
                                                          • SendMessageW.USER32(?,00001012,00000000,?), ref: 00B19A80
                                                          • SendMessageW.USER32 ref: 00B19AAE
                                                          • SendMessageW.USER32(?,00001111,00000000,?), ref: 00B19AEB
                                                          • SendMessageW.USER32 ref: 00B19B1A
                                                          • SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00B19B3B
                                                          • SendMessageW.USER32(?,0000110B,00000009,?), ref: 00B19B4A
                                                          • GetCursorPos.USER32(?), ref: 00B19B68
                                                          • ScreenToClient.USER32(?,?), ref: 00B19B75
                                                          • GetParent.USER32(?), ref: 00B19B93
                                                          • SendMessageW.USER32(?,00001012,00000000,?), ref: 00B19BFA
                                                          • SendMessageW.USER32 ref: 00B19C2B
                                                          • ClientToScreen.USER32(?,?), ref: 00B19C84
                                                          • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00B19CB4
                                                          • SendMessageW.USER32(?,00001111,00000000,?), ref: 00B19CDE
                                                          • SendMessageW.USER32 ref: 00B19D01
                                                          • ClientToScreen.USER32(?,?), ref: 00B19D4E
                                                          • TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00B19D82
                                                            • Part of subcall function 00A99944: GetWindowLongW.USER32(?,000000EB), ref: 00A99952
                                                          • GetWindowLongW.USER32(?,000000F0), ref: 00B19E05
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
                                                          • String ID: @GUI_DRAGID$F
                                                          • API String ID: 3429851547-4164748364
                                                          • Opcode ID: 3866d577d0f1ff954937800a6b954fd7da64b38b6ab993bae16e650ad8da3f46
                                                          • Instruction ID: f75a0bb681a6c8f04a267088a8e453b4697d732d0f7b81e759a8ffa1cd1e6a82
                                                          • Opcode Fuzzy Hash: 3866d577d0f1ff954937800a6b954fd7da64b38b6ab993bae16e650ad8da3f46
                                                          • Instruction Fuzzy Hash: A9428F71204281EFD724CF28CC54BEABBE5FF89310F544AA9F595872A1DB319C94CB51
                                                          Function 00B14873 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 566windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 00B148F3
                                                          • SendMessageW.USER32(00000000,00000188,00000000,00000000), ref: 00B14908
                                                          • SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00B14927
                                                          • SendMessageW.USER32(?,00000148,00000000,00000000), ref: 00B1494B
                                                          • SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 00B1495C
                                                          • SendMessageW.USER32(00000000,00000149,00000000,00000000), ref: 00B1497B
                                                          • SendMessageW.USER32(00000000,0000130B,00000000,00000000), ref: 00B149AE
                                                          • SendMessageW.USER32(00000000,0000133C,00000000,?), ref: 00B149D4
                                                          • SendMessageW.USER32(00000000,0000110A,00000009,00000000), ref: 00B14A0F
                                                          • SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00B14A56
                                                          • SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00B14A7E
                                                          • IsMenu.USER32(?), ref: 00B14A97
                                                          • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00B14AF2
                                                          • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00B14B20
                                                          • GetWindowLongW.USER32(?,000000F0), ref: 00B14B94
                                                          • SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 00B14BE3
                                                          • SendMessageW.USER32(00000000,00001001,00000000,?), ref: 00B14C82
                                                          • wsprintfW.USER32 ref: 00B14CAE
                                                          • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00B14CC9
                                                          • GetWindowTextW.USER32(?,00000000,00000001), ref: 00B14CF1
                                                          • SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00B14D13
                                                          • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00B14D33
                                                          • GetWindowTextW.USER32(?,00000000,00000001), ref: 00B14D5A
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$MenuWindow$InfoItemText$Longwsprintf
                                                          • String ID: %d/%02d/%02d
                                                          • API String ID: 4054740463-328681919
                                                          • Opcode ID: 6a2a9a35f54bf1224ee4e962a5cd3470d9f4e125662dfda8c84ede4b9c73cf31
                                                          • Instruction ID: 1622c0225e5d3a54343e3b479537721362b75bd8010a1413382bde88818bf174
                                                          • Opcode Fuzzy Hash: 6a2a9a35f54bf1224ee4e962a5cd3470d9f4e125662dfda8c84ede4b9c73cf31
                                                          • Instruction Fuzzy Hash: BE12BB71640214AFEB248F28CC89FEE7BE8EF45710F5441A9F51AEB2A1DB749981CB50
                                                          Function 00A9F98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 00A9F998
                                                          • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00ADF474
                                                          • IsIconic.USER32(00000000), ref: 00ADF47D
                                                          • ShowWindow.USER32(00000000,00000009), ref: 00ADF48A
                                                          • SetForegroundWindow.USER32(00000000), ref: 00ADF494
                                                          • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00ADF4AA
                                                          • GetCurrentThreadId.KERNEL32 ref: 00ADF4B1
                                                          • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00ADF4BD
                                                          • AttachThreadInput.USER32(?,00000000,00000001), ref: 00ADF4CE
                                                          • AttachThreadInput.USER32(?,00000000,00000001), ref: 00ADF4D6
                                                          • AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 00ADF4DE
                                                          • SetForegroundWindow.USER32(00000000), ref: 00ADF4E1
                                                          • MapVirtualKeyW.USER32(00000012,00000000), ref: 00ADF4F6
                                                          • keybd_event.USER32(00000012,00000000), ref: 00ADF501
                                                          • MapVirtualKeyW.USER32(00000012,00000000), ref: 00ADF50B
                                                          • keybd_event.USER32(00000012,00000000), ref: 00ADF510
                                                          • MapVirtualKeyW.USER32(00000012,00000000), ref: 00ADF519
                                                          • keybd_event.USER32(00000012,00000000), ref: 00ADF51E
                                                          • MapVirtualKeyW.USER32(00000012,00000000), ref: 00ADF528
                                                          • keybd_event.USER32(00000012,00000000), ref: 00ADF52D
                                                          • SetForegroundWindow.USER32(00000000), ref: 00ADF530
                                                          • AttachThreadInput.USER32(?,000000FF,00000000), ref: 00ADF557
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
                                                          • String ID: Shell_TrayWnd
                                                          • API String ID: 4125248594-2988720461
                                                          • Opcode ID: cdf5eeaa24ae4d422551c607b9086bc818a39103724c9c4e71df259906ca73b2
                                                          • Instruction ID: c99001258ad5bb2b62d7ed78150cad3b029e570d632f910afa8f94cfde8ed0a4
                                                          • Opcode Fuzzy Hash: cdf5eeaa24ae4d422551c607b9086bc818a39103724c9c4e71df259906ca73b2
                                                          • Instruction Fuzzy Hash: D2314371A80318BFEB216BB55C4AFBF7E6DEB44B50F504066FA02E71D1CBB15D00AA60
                                                          Function 00AE1201 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 241COMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00AE16C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00AE170D
                                                            • Part of subcall function 00AE16C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00AE173A
                                                            • Part of subcall function 00AE16C3: GetLastError.KERNEL32 ref: 00AE174A
                                                          • LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00AE1286
                                                          • DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 00AE12A8
                                                          • CloseHandle.KERNEL32(?), ref: 00AE12B9
                                                          • OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00AE12D1
                                                          • GetProcessWindowStation.USER32 ref: 00AE12EA
                                                          • SetProcessWindowStation.USER32(00000000), ref: 00AE12F4
                                                          • OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00AE1310
                                                            • Part of subcall function 00AE10BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00AE11FC), ref: 00AE10D4
                                                            • Part of subcall function 00AE10BF: CloseHandle.KERNEL32(?,?,00AE11FC), ref: 00AE10E9
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
                                                          • String ID: $default$winsta0
                                                          • API String ID: 22674027-1027155976
                                                          • Opcode ID: 2f952e2d944dd5a060511075eea0a5d9fe589db992a3bc829ae2e4e1fd547cc4
                                                          • Instruction ID: 5d4cbb71dcbaec49513a16278a315e0ddb304006866b55c26275bbea0534c9c8
                                                          • Opcode Fuzzy Hash: 2f952e2d944dd5a060511075eea0a5d9fe589db992a3bc829ae2e4e1fd547cc4
                                                          • Instruction Fuzzy Hash: 0581A0B1A40299AFDF219FA5DD49FEE7FB9EF04704F148129F911A72A0DB708954CB20
                                                          Function 00AE0B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00AE10F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00AE1114
                                                            • Part of subcall function 00AE10F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00AE0B9B,?,?,?), ref: 00AE1120
                                                            • Part of subcall function 00AE10F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00AE0B9B,?,?,?), ref: 00AE112F
                                                            • Part of subcall function 00AE10F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00AE0B9B,?,?,?), ref: 00AE1136
                                                            • Part of subcall function 00AE10F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00AE114D
                                                          • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00AE0BCC
                                                          • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00AE0C00
                                                          • GetLengthSid.ADVAPI32(?), ref: 00AE0C17
                                                          • GetAce.ADVAPI32(?,00000000,?), ref: 00AE0C51
                                                          • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00AE0C6D
                                                          • GetLengthSid.ADVAPI32(?), ref: 00AE0C84
                                                          • GetProcessHeap.KERNEL32(00000008,00000008), ref: 00AE0C8C
                                                          • HeapAlloc.KERNEL32(00000000), ref: 00AE0C93
                                                          • GetLengthSid.ADVAPI32(?,00000008,?), ref: 00AE0CB4
                                                          • CopySid.ADVAPI32(00000000), ref: 00AE0CBB
                                                          • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00AE0CEA
                                                          • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00AE0D0C
                                                          • SetUserObjectSecurity.USER32(?,00000004,?), ref: 00AE0D1E
                                                          • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00AE0D45
                                                          • HeapFree.KERNEL32(00000000), ref: 00AE0D4C
                                                          • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00AE0D55
                                                          • HeapFree.KERNEL32(00000000), ref: 00AE0D5C
                                                          • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00AE0D65
                                                          • HeapFree.KERNEL32(00000000), ref: 00AE0D6C
                                                          • GetProcessHeap.KERNEL32(00000000,?), ref: 00AE0D78
                                                          • HeapFree.KERNEL32(00000000), ref: 00AE0D7F
                                                            • Part of subcall function 00AE1193: GetProcessHeap.KERNEL32(00000008,00AE0BB1,?,00000000,?,00AE0BB1,?), ref: 00AE11A1
                                                            • Part of subcall function 00AE1193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00AE0BB1,?), ref: 00AE11A8
                                                            • Part of subcall function 00AE1193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00AE0BB1,?), ref: 00AE11B7
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
                                                          • String ID:
                                                          • API String ID: 4175595110-0
                                                          • Opcode ID: 0a6519f26cdedf87c125d92ea647da77c897df16680e61e79d0fc460b81d1c97
                                                          • Instruction ID: c29a2b3d2f78f0dda76b0ccf5bd91b40ceb7d7517ae2e483afc2710b6248f80c
                                                          • Opcode Fuzzy Hash: 0a6519f26cdedf87c125d92ea647da77c897df16680e61e79d0fc460b81d1c97
                                                          • Instruction Fuzzy Hash: 23715C7294024AEBDF10DFA5DC88FEEBBB8FF08300F148515E915A7191DBB5AA45CB60
                                                          Function 00AFEAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • OpenClipboard.USER32(00B1CC08), ref: 00AFEB29
                                                          • IsClipboardFormatAvailable.USER32(0000000D), ref: 00AFEB37
                                                          • GetClipboardData.USER32(0000000D), ref: 00AFEB43
                                                          • CloseClipboard.USER32 ref: 00AFEB4F
                                                          • GlobalLock.KERNEL32(00000000), ref: 00AFEB87
                                                          • CloseClipboard.USER32 ref: 00AFEB91
                                                          • GlobalUnlock.KERNEL32(00000000), ref: 00AFEBBC
                                                          • IsClipboardFormatAvailable.USER32(00000001), ref: 00AFEBC9
                                                          • GetClipboardData.USER32(00000001), ref: 00AFEBD1
                                                          • GlobalLock.KERNEL32(00000000), ref: 00AFEBE2
                                                          • GlobalUnlock.KERNEL32(00000000), ref: 00AFEC22
                                                          • IsClipboardFormatAvailable.USER32(0000000F), ref: 00AFEC38
                                                          • GetClipboardData.USER32(0000000F), ref: 00AFEC44
                                                          • GlobalLock.KERNEL32(00000000), ref: 00AFEC55
                                                          • DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 00AFEC77
                                                          • DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00AFEC94
                                                          • DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00AFECD2
                                                          • GlobalUnlock.KERNEL32(00000000), ref: 00AFECF3
                                                          • CountClipboardFormats.USER32 ref: 00AFED14
                                                          • CloseClipboard.USER32 ref: 00AFED59
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
                                                          • String ID:
                                                          • API String ID: 420908878-0
                                                          • Opcode ID: 61213cf9bfa17d5f22bba42af2de622772183f134fc391e5bcf9384712aac4a9
                                                          • Instruction ID: 65eca84ac2b1f306c65b8878b438251491c362fc5de42e0834144c4ea3ce4857
                                                          • Opcode Fuzzy Hash: 61213cf9bfa17d5f22bba42af2de622772183f134fc391e5bcf9384712aac4a9
                                                          • Instruction Fuzzy Hash: 8761BC34244205AFD310EFA4C888FBA7BA4AF84704F488559F596972A2DF31DD06CBA2
                                                          Function 00AF698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • FindFirstFileW.KERNEL32(?,?), ref: 00AF69BE
                                                          • FindClose.KERNEL32(00000000), ref: 00AF6A12
                                                          • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00AF6A4E
                                                          • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00AF6A75
                                                            • Part of subcall function 00A89CB3: _wcslen.LIBCMT ref: 00A89CBD
                                                          • FileTimeToSystemTime.KERNEL32(?,?), ref: 00AF6AB2
                                                          • FileTimeToSystemTime.KERNEL32(?,?), ref: 00AF6ADF
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
                                                          • String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
                                                          • API String ID: 3830820486-3289030164
                                                          • Opcode ID: 03bce68515b9d767fb44ef4151beda1e36e693f5189286deaa4d904197ef0f93
                                                          • Instruction ID: 0093f9f673340a60752115da354e22f2e5807072404a167676b0d3663c19d43a
                                                          • Opcode Fuzzy Hash: 03bce68515b9d767fb44ef4151beda1e36e693f5189286deaa4d904197ef0f93
                                                          • Instruction Fuzzy Hash: DAD13DB2508304AFC714EBA4C982EBBB7ECAF98704F44491DF685D7191EB74DA44CB62
                                                          Function 00AF9642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00AF9663
                                                          • GetFileAttributesW.KERNEL32(?), ref: 00AF96A1
                                                          • SetFileAttributesW.KERNEL32(?,?), ref: 00AF96BB
                                                          • FindNextFileW.KERNEL32(00000000,?), ref: 00AF96D3
                                                          • FindClose.KERNEL32(00000000), ref: 00AF96DE
                                                          • FindFirstFileW.KERNEL32(*.*,?), ref: 00AF96FA
                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 00AF974A
                                                          • SetCurrentDirectoryW.KERNEL32(00B46B7C), ref: 00AF9768
                                                          • FindNextFileW.KERNEL32(00000000,00000010), ref: 00AF9772
                                                          • FindClose.KERNEL32(00000000), ref: 00AF977F
                                                          • FindClose.KERNEL32(00000000), ref: 00AF978F
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
                                                          • String ID: *.*
                                                          • API String ID: 1409584000-438819550
                                                          • Opcode ID: a9cfb5805ae896988455e6bd8094d7331c686cd179c2810adc18969c4a9f8894
                                                          • Instruction ID: 11d4a5826fd1e9724d2e095fe0442cc07d55f1f7bea7e66dc8dc90fcf03e5d77
                                                          • Opcode Fuzzy Hash: a9cfb5805ae896988455e6bd8094d7331c686cd179c2810adc18969c4a9f8894
                                                          • Instruction Fuzzy Hash: AB31A23254021D6BDB14AFF4EC49BEF7BAC9F09321F508195FA15E30A0DB74DE448A54
                                                          Function 00AF979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00AF97BE
                                                          • FindNextFileW.KERNEL32(00000000,?), ref: 00AF9819
                                                          • FindClose.KERNEL32(00000000), ref: 00AF9824
                                                          • FindFirstFileW.KERNEL32(*.*,?), ref: 00AF9840
                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 00AF9890
                                                          • SetCurrentDirectoryW.KERNEL32(00B46B7C), ref: 00AF98AE
                                                          • FindNextFileW.KERNEL32(00000000,00000010), ref: 00AF98B8
                                                          • FindClose.KERNEL32(00000000), ref: 00AF98C5
                                                          • FindClose.KERNEL32(00000000), ref: 00AF98D5
                                                            • Part of subcall function 00AEDAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00AEDB00
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
                                                          • String ID: *.*
                                                          • API String ID: 2640511053-438819550
                                                          • Opcode ID: 09ce8a1625d62c58f1ac1851d5b743f652b012de5517657bd785fa251ab5e530
                                                          • Instruction ID: 36ca15ffe86da62074de78293d6bbdf106d1f098afa0aef23a14294c0f6bc2d4
                                                          • Opcode Fuzzy Hash: 09ce8a1625d62c58f1ac1851d5b743f652b012de5517657bd785fa251ab5e530
                                                          • Instruction Fuzzy Hash: D831C33254021D6ADB14AFF4EC49BEF7BACDF06360F108195F954A31E0DB70DE848AA4
                                                          Function 00B0BE44 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00B0C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00B0B6AE,?,?), ref: 00B0C9B5
                                                            • Part of subcall function 00B0C998: _wcslen.LIBCMT ref: 00B0C9F1
                                                            • Part of subcall function 00B0C998: _wcslen.LIBCMT ref: 00B0CA68
                                                            • Part of subcall function 00B0C998: _wcslen.LIBCMT ref: 00B0CA9E
                                                          • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00B0BF3E
                                                          • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 00B0BFA9
                                                          • RegCloseKey.ADVAPI32(00000000), ref: 00B0BFCD
                                                          • RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00B0C02C
                                                          • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00B0C0E7
                                                          • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00B0C154
                                                          • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00B0C1E9
                                                          • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 00B0C23A
                                                          • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00B0C2E3
                                                          • RegCloseKey.ADVAPI32(?,?,00000000), ref: 00B0C382
                                                          • RegCloseKey.ADVAPI32(00000000), ref: 00B0C38F
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
                                                          • String ID:
                                                          • API String ID: 3102970594-0
                                                          • Opcode ID: be4628a82added75a7aa841a884ca8f4e697cba249719110c2782189c8898c9d
                                                          • Instruction ID: ad52027597cc51c446224256ad45da65a8f745b7090da2df40bf37fe4fabfe1b
                                                          • Opcode Fuzzy Hash: be4628a82added75a7aa841a884ca8f4e697cba249719110c2782189c8898c9d
                                                          • Instruction Fuzzy Hash: 9B025D716042009FD714DF28C995E2ABBE5EF89318F18C59DF84ADB2A2DB31EC45CB52
                                                          Function 00AF8195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetLocalTime.KERNEL32(?), ref: 00AF8257
                                                          • SystemTimeToFileTime.KERNEL32(?,?), ref: 00AF8267
                                                          • LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00AF8273
                                                          • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00AF8310
                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 00AF8324
                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 00AF8356
                                                          • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00AF838C
                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 00AF8395
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: CurrentDirectoryTime$File$Local$System
                                                          • String ID: *.*
                                                          • API String ID: 1464919966-438819550
                                                          • Opcode ID: 6bcbbe268e0b1ce39d3d4e4b2a5395bfd85a6e0149ce47cab6c67746e537fb95
                                                          • Instruction ID: 32051b9cfd1a9c4e8bd9f59beef77782e6ad2a027ac8bacbc800ef5eb93e65ce
                                                          • Opcode Fuzzy Hash: 6bcbbe268e0b1ce39d3d4e4b2a5395bfd85a6e0149ce47cab6c67746e537fb95
                                                          • Instruction Fuzzy Hash: 57618BB25043099FCB10EF60C9409AFB7E8FF89714F04891EFA9987251DB35E945CB92
                                                          Function 00AED076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00A83AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00A83A97,?,?,00A82E7F,?,?,?,00000000), ref: 00A83AC2
                                                            • Part of subcall function 00AEE199: GetFileAttributesW.KERNEL32(?,00AECF95), ref: 00AEE19A
                                                          • FindFirstFileW.KERNEL32(?,?), ref: 00AED122
                                                          • DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 00AED1DD
                                                          • MoveFileW.KERNEL32(?,?), ref: 00AED1F0
                                                          • DeleteFileW.KERNEL32(?,?,?,?), ref: 00AED20D
                                                          • FindNextFileW.KERNEL32(00000000,00000010), ref: 00AED237
                                                            • Part of subcall function 00AED29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,00AED21C,?,?), ref: 00AED2B2
                                                          • FindClose.KERNEL32(00000000,?,?,?), ref: 00AED253
                                                          • FindClose.KERNEL32(00000000), ref: 00AED264
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
                                                          • String ID: \*.*
                                                          • API String ID: 1946585618-1173974218
                                                          • Opcode ID: 19a1fbfb2723afd52e01d474c34abc81014f0d70c3c0f3f8052e5a1eaa492cb6
                                                          • Instruction ID: 773eb41713eccbf4402595b0baabc6cd8e261d1d8bdf2197a5bd629b8caa02ae
                                                          • Opcode Fuzzy Hash: 19a1fbfb2723afd52e01d474c34abc81014f0d70c3c0f3f8052e5a1eaa492cb6
                                                          • Instruction Fuzzy Hash: 0B615B3180514DABCF05FBE1CA929FEBBB5AF25300F648169E40277191EB31AF09DB61
                                                          Function 00AFED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Clipboard$AllocCloseEmptyGlobalOpen
                                                          • String ID:
                                                          • API String ID: 1737998785-0
                                                          • Opcode ID: af9a3ef8ef8e53c79e328b08e274697bdcd5115abc236c349af198df0037c115
                                                          • Instruction ID: 79a95a6904572e620bdd06bbf713174e58427e41e2642bfe31d36e9f6eebb1a1
                                                          • Opcode Fuzzy Hash: af9a3ef8ef8e53c79e328b08e274697bdcd5115abc236c349af198df0037c115
                                                          • Instruction Fuzzy Hash: 4441BE35204611AFE320DF55E888B69BBE5FF44328F54C4A9F5558BA72CB35EC41CB90
                                                          Function 00AEE8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00AE16C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00AE170D
                                                            • Part of subcall function 00AE16C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00AE173A
                                                            • Part of subcall function 00AE16C3: GetLastError.KERNEL32 ref: 00AE174A
                                                          • ExitWindowsEx.USER32(?,00000000), ref: 00AEE932
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
                                                          • String ID: $ $@$SeShutdownPrivilege
                                                          • API String ID: 2234035333-3163812486
                                                          • Opcode ID: 51cbaaf0018f5be85d6040b6eea9415b9a15a5306df5722d4c4e7233fc8c1ea1
                                                          • Instruction ID: 3b91874b001344c0658f943144be4fe9e4ff5367617d301409d7b6b0e21bdedd
                                                          • Opcode Fuzzy Hash: 51cbaaf0018f5be85d6040b6eea9415b9a15a5306df5722d4c4e7233fc8c1ea1
                                                          • Instruction Fuzzy Hash: E601F972650251ABEB54A7B69C8AFFFB2EC9718750F154422FC13E71D3EAB09C4481A4
                                                          Function 00B01204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00B01276
                                                          • WSAGetLastError.WSOCK32 ref: 00B01283
                                                          • bind.WSOCK32(00000000,?,00000010), ref: 00B012BA
                                                          • WSAGetLastError.WSOCK32 ref: 00B012C5
                                                          • closesocket.WSOCK32(00000000), ref: 00B012F4
                                                          • listen.WSOCK32(00000000,00000005), ref: 00B01303
                                                          • WSAGetLastError.WSOCK32 ref: 00B0130D
                                                          • closesocket.WSOCK32(00000000), ref: 00B0133C
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: ErrorLast$closesocket$bindlistensocket
                                                          • String ID:
                                                          • API String ID: 540024437-0
                                                          • Opcode ID: ba38ec928b4b33a0d8c8afdc366d59270b205a32d2068a2c6bf2ba908bc8e29d
                                                          • Instruction ID: a1aebc5216adb2995f8d11420cccc0a5127f33027ed4e272f202f5520e213c01
                                                          • Opcode Fuzzy Hash: ba38ec928b4b33a0d8c8afdc366d59270b205a32d2068a2c6bf2ba908bc8e29d
                                                          • Instruction Fuzzy Hash: 2D416D71600100AFD714DF68C588B69BFE5EF46318F588598E8569F2D2C771ED81CBA1
                                                          Function 00AED3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00A83AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00A83A97,?,?,00A82E7F,?,?,?,00000000), ref: 00A83AC2
                                                            • Part of subcall function 00AEE199: GetFileAttributesW.KERNEL32(?,00AECF95), ref: 00AEE19A
                                                          • FindFirstFileW.KERNEL32(?,?), ref: 00AED420
                                                          • DeleteFileW.KERNEL32(?,?,?,?), ref: 00AED470
                                                          • FindNextFileW.KERNEL32(00000000,00000010), ref: 00AED481
                                                          • FindClose.KERNEL32(00000000), ref: 00AED498
                                                          • FindClose.KERNEL32(00000000), ref: 00AED4A1
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
                                                          • String ID: \*.*
                                                          • API String ID: 2649000838-1173974218
                                                          • Opcode ID: 67c5d8d39828dd213384b6cc03f0e89c868a3327b08bacc3335e4eb6ae2d5ccd
                                                          • Instruction ID: 6389eb92870ed2a4460581f46f2fb2ae23b88ff0ab0923a6cc9d7d0600328c36
                                                          • Opcode Fuzzy Hash: 67c5d8d39828dd213384b6cc03f0e89c868a3327b08bacc3335e4eb6ae2d5ccd
                                                          • Instruction Fuzzy Hash: 683160710083859BC305FF64D9958AFB7E8AEA5314F844A1EF4D593191EB30AA09D763
                                                          Function 00ABE4FF Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: __floor_pentium4
                                                          • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                          • API String ID: 4168288129-2761157908
                                                          • Opcode ID: 51c0e5b5be58e30553588eb440b76362d54d8e536541d8e4bad2bbb0069bde29
                                                          • Instruction ID: cd4ce8154468fbca8f16f78984a23dbf18b6545926ebb2fced6c69dc5689510d
                                                          • Opcode Fuzzy Hash: 51c0e5b5be58e30553588eb440b76362d54d8e536541d8e4bad2bbb0069bde29
                                                          • Instruction Fuzzy Hash: 07C23C71E046288FDB25CF68DD407EAB7B9EB49305F1841EAD84DE7242E775AE818F40
                                                          Function 00AF648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • _wcslen.LIBCMT ref: 00AF64DC
                                                          • CoInitialize.OLE32(00000000), ref: 00AF6639
                                                          • CoCreateInstance.OLE32(00B1FCF8,00000000,00000001,00B1FB68,?), ref: 00AF6650
                                                          • CoUninitialize.OLE32 ref: 00AF68D4
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: CreateInitializeInstanceUninitialize_wcslen
                                                          • String ID: .lnk
                                                          • API String ID: 886957087-24824748
                                                          • Opcode ID: a0266997ead616ea7ab75e835d9747c8b8c722686cc185b6dbe9e17d3c395cdf
                                                          • Instruction ID: f61de2b5f63e1271355a7624d815bde2df4a44444e55f8140a4a2555e3adea20
                                                          • Opcode Fuzzy Hash: a0266997ead616ea7ab75e835d9747c8b8c722686cc185b6dbe9e17d3c395cdf
                                                          • Instruction Fuzzy Hash: DAD16971508305AFD304EF64C981A6BB7E8FF98704F14496DF5959B2A1EB30ED09CBA2
                                                          Function 00B022DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetForegroundWindow.USER32(?,?,00000000), ref: 00B022E8
                                                            • Part of subcall function 00AFE4EC: GetWindowRect.USER32(?,?), ref: 00AFE504
                                                          • GetDesktopWindow.USER32 ref: 00B02312
                                                          • GetWindowRect.USER32(00000000), ref: 00B02319
                                                          • mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00B02355
                                                          • GetCursorPos.USER32(?), ref: 00B02381
                                                          • mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00B023DF
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Window$Rectmouse_event$CursorDesktopForeground
                                                          • String ID:
                                                          • API String ID: 2387181109-0
                                                          • Opcode ID: 1765d3caa64d80a1587d510bab4b29c8a205e170d1e0a899996c76d8e8ab8c97
                                                          • Instruction ID: 88da68813256f7e9850c19172f89eb056ee1ad26fa6af38e578ecc8abdc07233
                                                          • Opcode Fuzzy Hash: 1765d3caa64d80a1587d510bab4b29c8a205e170d1e0a899996c76d8e8ab8c97
                                                          • Instruction Fuzzy Hash: 3931E072504315AFCB20DF54D849B9BBBEAFF84310F00491AF98997191DB34EA08CB96
                                                          Function 00AF9B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00A89CB3: _wcslen.LIBCMT ref: 00A89CBD
                                                          • FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00AF9B78
                                                          • FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00AF9C8B
                                                            • Part of subcall function 00AF3874: GetInputState.USER32 ref: 00AF38CB
                                                            • Part of subcall function 00AF3874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00AF3966
                                                          • Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00AF9BA8
                                                          • FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00AF9C75
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
                                                          • String ID: *.*
                                                          • API String ID: 1972594611-438819550
                                                          • Opcode ID: 7f77bf3ed768aa6d69fb27b30746c5032e3b44c374662ba4db3bc5dc9ed82144
                                                          • Instruction ID: cc1a6a485f660a2999425aa291ef1bb4c73862f42a523b1f08e711134dcda93e
                                                          • Opcode Fuzzy Hash: 7f77bf3ed768aa6d69fb27b30746c5032e3b44c374662ba4db3bc5dc9ed82144
                                                          • Instruction Fuzzy Hash: 3241487194420EAFCF54EFA4C985BEEBBB8EF05310F244056F905A2191EB309E85CBA1
                                                          Function 00A9997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00A99BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00A99BB2
                                                          • DefDlgProcW.USER32(?,?,?,?,?), ref: 00A99A4E
                                                          • GetSysColor.USER32(0000000F), ref: 00A99B23
                                                          • SetBkColor.GDI32(?,00000000), ref: 00A99B36
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Color$LongProcWindow
                                                          • String ID:
                                                          • API String ID: 3131106179-0
                                                          • Opcode ID: 0294db8c13c6a8bb74973c56e25de81460fc95eeeb2703865debb6d2be8b7817
                                                          • Instruction ID: 4851ccfee9d54217e2d49a0f5b77b3d55825c50a0c5994b336fdbc43a106b223
                                                          • Opcode Fuzzy Hash: 0294db8c13c6a8bb74973c56e25de81460fc95eeeb2703865debb6d2be8b7817
                                                          • Instruction Fuzzy Hash: 5FA1E770308544BFEF299B2C8C99FBF36EDEB46380B14454EF503D6A91EA259D42D272
                                                          Function 00B01806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00B0304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00B0307A
                                                            • Part of subcall function 00B0304E: _wcslen.LIBCMT ref: 00B0309B
                                                          • socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00B0185D
                                                          • WSAGetLastError.WSOCK32 ref: 00B01884
                                                          • bind.WSOCK32(00000000,?,00000010), ref: 00B018DB
                                                          • WSAGetLastError.WSOCK32 ref: 00B018E6
                                                          • closesocket.WSOCK32(00000000), ref: 00B01915
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
                                                          • String ID:
                                                          • API String ID: 1601658205-0
                                                          • Opcode ID: 1ab6ed3fe6fa37056753b71dae8808e3ab93f1cf0ffabd7f083431573ace8e61
                                                          • Instruction ID: ed31004820fa7e4204fd8e7235f5b45ac07afa22149476e45ddd7bea7461ec5e
                                                          • Opcode Fuzzy Hash: 1ab6ed3fe6fa37056753b71dae8808e3ab93f1cf0ffabd7f083431573ace8e61
                                                          • Instruction Fuzzy Hash: A751D471A002109FEB14AF28C986F6A7BE5EB44718F54C498F9065F3D3D771AD41CBA1
                                                          Function 00B11C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Window$EnabledForegroundIconicVisibleZoomed
                                                          • String ID:
                                                          • API String ID: 292994002-0
                                                          • Opcode ID: 57d3bb5c4de6186ae37357a9f86f093586edfbbd7d550940bb5f7d024aa240c7
                                                          • Instruction ID: 4ef54ba1977b7beb262436abf541f01f71dc7f6b56f6c839ce2bb59516dba315
                                                          • Opcode Fuzzy Hash: 57d3bb5c4de6186ae37357a9f86f093586edfbbd7d550940bb5f7d024aa240c7
                                                          • Instruction Fuzzy Hash: 1221A3317802115FD7209F2ED884BAA7BE5EF95324B9984A8E946CF351CB71DC82CBD0
                                                          Function 00A88060 Relevance: 7.4, Strings: 5, Instructions: 1151COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: ERCP$VUUU$VUUU$VUUU$VUUU
                                                          • API String ID: 0-1546025612
                                                          • Opcode ID: a023ddc79a74144d865e5eae7ae11a1cc9a7547bd328cd0132b88779c6d9ec58
                                                          • Instruction ID: 83abbdf3cc227138b27a6a861a5d0fb10c6efc6637a94c267baddb7105d16d7c
                                                          • Opcode Fuzzy Hash: a023ddc79a74144d865e5eae7ae11a1cc9a7547bd328cd0132b88779c6d9ec58
                                                          • Instruction Fuzzy Hash: 82A27171E0061ACBDF24DF58C940BEEB7B1BF54310F6581AAE815AB285EB749D81CF90
                                                          Function 00AEAA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 00AEAAAC
                                                          • SetKeyboardState.USER32(00000080), ref: 00AEAAC8
                                                          • PostMessageW.USER32(?,00000102,00000001,00000001), ref: 00AEAB36
                                                          • SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 00AEAB88
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: KeyboardState$InputMessagePostSend
                                                          • String ID:
                                                          • API String ID: 432972143-0
                                                          • Opcode ID: a4e66b3ef7f87116fa97e82dbdb61a17f41e5a53f520163d1668c568f4c0e29d
                                                          • Instruction ID: f0af9e119849d5cca53902eab971261c663e93c7afcc52f709b4be8123edd5f0
                                                          • Opcode Fuzzy Hash: a4e66b3ef7f87116fa97e82dbdb61a17f41e5a53f520163d1668c568f4c0e29d
                                                          • Instruction Fuzzy Hash: 72310870A80388AEFF35CB66CC05BFA7BA6EB64310F04821AF581961D1D775AD85C762
                                                          Function 00ABBB6F Relevance: 6.1, APIs: 4, Instructions: 90timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • _free.LIBCMT ref: 00ABBB7F
                                                            • Part of subcall function 00AB29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00ABD7D1,00000000,00000000,00000000,00000000,?,00ABD7F8,00000000,00000007,00000000,?,00ABDBF5,00000000), ref: 00AB29DE
                                                            • Part of subcall function 00AB29C8: GetLastError.KERNEL32(00000000,?,00ABD7D1,00000000,00000000,00000000,00000000,?,00ABD7F8,00000000,00000007,00000000,?,00ABDBF5,00000000,00000000), ref: 00AB29F0
                                                          • GetTimeZoneInformation.KERNEL32 ref: 00ABBB91
                                                          • WideCharToMultiByte.KERNEL32(00000000,?,00B5121C,000000FF,?,0000003F,?,?), ref: 00ABBC09
                                                          • WideCharToMultiByte.KERNEL32(00000000,?,00B51270,000000FF,?,0000003F,?,?,?,00B5121C,000000FF,?,0000003F,?,?), ref: 00ABBC36
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: ByteCharMultiWide$ErrorFreeHeapInformationLastTimeZone_free
                                                          • String ID:
                                                          • API String ID: 806657224-0
                                                          • Opcode ID: 4ff3f41808ef8472b43faa447929b95ec9ef9c1d830394cbdf2d055626078925
                                                          • Instruction ID: 4b0efcfdc5a201d768f9cecd981520641478f27daf93c7fe1680cde98a1cbace
                                                          • Opcode Fuzzy Hash: 4ff3f41808ef8472b43faa447929b95ec9ef9c1d830394cbdf2d055626078925
                                                          • Instruction Fuzzy Hash: 3E31C070944205EFCB11DF68CC80AADBFBCBF46311B144AAAE014DB2A2DB719E40CB60
                                                          Function 00AFCE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • InternetReadFile.WININET(?,?,00000400,?), ref: 00AFCE89
                                                          • GetLastError.KERNEL32(?,00000000), ref: 00AFCEEA
                                                          • SetEvent.KERNEL32(?,?,00000000), ref: 00AFCEFE
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: ErrorEventFileInternetLastRead
                                                          • String ID:
                                                          • API String ID: 234945975-0
                                                          • Opcode ID: e2c9fbc0d6ce9420b7f98fe1bacd4bc78ad7c46bbfccbe5bc0454bac0ed2af19
                                                          • Instruction ID: d2b0068455f9208002f408f2bc4f67e4db9802e09096e65faa4c298778e18467
                                                          • Opcode Fuzzy Hash: e2c9fbc0d6ce9420b7f98fe1bacd4bc78ad7c46bbfccbe5bc0454bac0ed2af19
                                                          • Instruction Fuzzy Hash: 32215E7154070DABD720DFA6DA44BA6BBF8EF50364F10841AF646D3151EB74EE048B54
                                                          Function 00AE8298 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 568stringCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • lstrlenW.KERNEL32(?,?,?,00000000), ref: 00AE82AA
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: lstrlen
                                                          • String ID: ($|
                                                          • API String ID: 1659193697-1631851259
                                                          • Opcode ID: b0b0b169828a664d3c0d25298dd80fae242ce2571c2a6197ca92a2754aa57427
                                                          • Instruction ID: e82fe329077f8f6dcfc38cceaaa592bd125d409cd3bb082516382997063adf51
                                                          • Opcode Fuzzy Hash: b0b0b169828a664d3c0d25298dd80fae242ce2571c2a6197ca92a2754aa57427
                                                          • Instruction Fuzzy Hash: F0323575A007469FCB28CF5AC481A6AB7F0FF48710B15C56EE49ADB3A1EB74E941CB40
                                                          Function 00AF5C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • FindFirstFileW.KERNEL32(?,?), ref: 00AF5CC1
                                                          • FindNextFileW.KERNEL32(00000000,?), ref: 00AF5D17
                                                          • FindClose.KERNEL32(?), ref: 00AF5D5F
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Find$File$CloseFirstNext
                                                          • String ID:
                                                          • API String ID: 3541575487-0
                                                          • Opcode ID: 527ecaeca86188e0b75e909112e5344ffc7d790f704110c2721b64397c290ffa
                                                          • Instruction ID: 5df8178655b7a0fc9449b36c3e5a66f3839fa7dc4fae917aa3de97bc884d2d42
                                                          • Opcode Fuzzy Hash: 527ecaeca86188e0b75e909112e5344ffc7d790f704110c2721b64397c290ffa
                                                          • Instruction Fuzzy Hash: 1551AC34A046059FC714DF68C484AA6B7E4FF0A324F14855DFA9A8B3A1DB30ED04CF91
                                                          Function 00AB2622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          • IsDebuggerPresent.KERNEL32 ref: 00AB271A
                                                          • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00AB2724
                                                          • UnhandledExceptionFilter.KERNEL32(?), ref: 00AB2731
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: ExceptionFilterUnhandled$DebuggerPresent
                                                          • String ID:
                                                          • API String ID: 3906539128-0
                                                          • Opcode ID: c8ec7c3abe1992cca2fa021a7a76b6e0a8bc7bf99e76673835b057dc4c9fcc2a
                                                          • Instruction ID: 4f33a31608c5fb75d33d16ecadde4b2f2727c541a0e9b8a0fbe8029d40ff41c5
                                                          • Opcode Fuzzy Hash: c8ec7c3abe1992cca2fa021a7a76b6e0a8bc7bf99e76673835b057dc4c9fcc2a
                                                          • Instruction Fuzzy Hash: 3D31D5749412189BCB21DF68DD88BDDBBB8AF08310F5041EAE41CA72A1EB309F818F44
                                                          Function 00AF51CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SetErrorMode.KERNEL32(00000001), ref: 00AF51DA
                                                          • GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00AF5238
                                                          • SetErrorMode.KERNEL32(00000000), ref: 00AF52A1
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: ErrorMode$DiskFreeSpace
                                                          • String ID:
                                                          • API String ID: 1682464887-0
                                                          • Opcode ID: a1bde0c2520100abf49debae49f31a890a2c5fd11a78ef0024e6bb699dedfc3f
                                                          • Instruction ID: 5d0bd1ca2b7b7bab36a5adf33afe96e1a9e82b29c00c8fac127b04531b2c8709
                                                          • Opcode Fuzzy Hash: a1bde0c2520100abf49debae49f31a890a2c5fd11a78ef0024e6bb699dedfc3f
                                                          • Instruction Fuzzy Hash: 2D314F75A00518DFDB00DF94D884EEDBBB4FF49314F048099E905AB352DB31E855CBA0
                                                          Function 00AE16C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00A9FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00AA0668
                                                            • Part of subcall function 00A9FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00AA0685
                                                          • LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00AE170D
                                                          • AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00AE173A
                                                          • GetLastError.KERNEL32 ref: 00AE174A
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
                                                          • String ID:
                                                          • API String ID: 577356006-0
                                                          • Opcode ID: 0a44bc970848e3bd27a9b75e65008f08b8360b5d62df1e3984e81f81d6b22ab0
                                                          • Instruction ID: 7d224c814fc1e6a073da4e7e16bdc074093fefbe7f7b01424c1f9c795938d91e
                                                          • Opcode Fuzzy Hash: 0a44bc970848e3bd27a9b75e65008f08b8360b5d62df1e3984e81f81d6b22ab0
                                                          • Instruction Fuzzy Hash: 3B11CEB2510304AFD718AF54EC86DAABBF9EB08B14B20852EE05697641EB70BC41CA24
                                                          Function 00AED5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00AED608
                                                          • DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 00AED645
                                                          • CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00AED650
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: CloseControlCreateDeviceFileHandle
                                                          • String ID:
                                                          • API String ID: 33631002-0
                                                          • Opcode ID: 295a834c4fb48881058d8742ed6f72e6316353c022275d871a4485b1ac2d7c80
                                                          • Instruction ID: c340cceead0974c0ff8891070722e609ab7d8a4acb19cf3434a6924f8e0a887f
                                                          • Opcode Fuzzy Hash: 295a834c4fb48881058d8742ed6f72e6316353c022275d871a4485b1ac2d7c80
                                                          • Instruction Fuzzy Hash: 13113C75E45228BBDB108F95AC45FEFBFBCEB45B50F108115F914E7290D6704A058BA1
                                                          Function 00AE1663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00AE168C
                                                          • CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00AE16A1
                                                          • FreeSid.ADVAPI32(?), ref: 00AE16B1
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: AllocateCheckFreeInitializeMembershipToken
                                                          • String ID:
                                                          • API String ID: 3429775523-0
                                                          • Opcode ID: 55e50b9a131c8b7de9fcc8df639eb9d6386ea525acebe73111ad181170e71f64
                                                          • Instruction ID: 8aa8dde40552bf11f4b27a7b9f3a7a757650272b79daf6b338e387d9f20e2156
                                                          • Opcode Fuzzy Hash: 55e50b9a131c8b7de9fcc8df639eb9d6386ea525acebe73111ad181170e71f64
                                                          • Instruction Fuzzy Hash: EDF0F471990309FBDB00DFE49C89EAEBBBCEB08604F508565E501E2181E774AA448A50
                                                          Function 00ADD27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetUserNameW.ADVAPI32(?,?), ref: 00ADD28C
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: NameUser
                                                          • String ID: X64
                                                          • API String ID: 2645101109-893830106
                                                          • Opcode ID: 9b8c01fb8d14535b421e9fbc08af6a3fedd016068bd12aad8b884ec8403ca338
                                                          • Instruction ID: 88e7a58779805b86ea4b82cd9bf63e583fbd2eb44ba1f488c513cbdfe351344f
                                                          • Opcode Fuzzy Hash: 9b8c01fb8d14535b421e9fbc08af6a3fedd016068bd12aad8b884ec8403ca338
                                                          • Instruction Fuzzy Hash: 0FD0CAB480122DEACF94CBA0EC88DDAB7BCBB08345F204292F146A2100DB3096888F20
                                                          Function 00AACAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
                                                          • Instruction ID: f0c1a4aec0f960fa73f5699264b99f5ea929de64bbb3b2cf06fbe6dddf5bfdb7
                                                          • Opcode Fuzzy Hash: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
                                                          • Instruction Fuzzy Hash: A3021E71E002199FEF24CFA9C9806ADFBF1EF49324F258169D919E7384D731AE418B94
                                                          Function 00AF68EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • FindFirstFileW.KERNEL32(?,?), ref: 00AF6918
                                                          • FindClose.KERNEL32(00000000), ref: 00AF6961
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Find$CloseFileFirst
                                                          • String ID:
                                                          • API String ID: 2295610775-0
                                                          • Opcode ID: a4e76a629afdb182037d4414f731fb9629bd4c09b121a4b2678116809cf4d58c
                                                          • Instruction ID: 63e788d81139e1af7025120fbba72a8b35b15c6a39bec8c93a09892d9db5daef
                                                          • Opcode Fuzzy Hash: a4e76a629afdb182037d4414f731fb9629bd4c09b121a4b2678116809cf4d58c
                                                          • Instruction Fuzzy Hash: 04118E316042049FD710DF69D4C4A26BBE5FF85328F54C699F5698F6A2CB70EC05CB91
                                                          Function 00AF37B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00B04891,?,?,00000035,?), ref: 00AF37E4
                                                          • FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00B04891,?,?,00000035,?), ref: 00AF37F4
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: ErrorFormatLastMessage
                                                          • String ID:
                                                          • API String ID: 3479602957-0
                                                          • Opcode ID: 7cbaa96a44db0fdd4a4948804079b96c27f3ed4bfb8234607a58e278da4ed3a3
                                                          • Instruction ID: 03bf59dc581deae2dfd1d9fcb77b94dbb49adb7a5fe4a611bb915d3bfccb2040
                                                          • Opcode Fuzzy Hash: 7cbaa96a44db0fdd4a4948804079b96c27f3ed4bfb8234607a58e278da4ed3a3
                                                          • Instruction Fuzzy Hash: BFF0E5B17042282AEB2067A69D4DFEB7AAEEFC5761F000165F609D3281D9B09944C7F0
                                                          Function 00AEB226 Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00AEB25D
                                                          • keybd_event.USER32(?,75C0C0D0,?,00000000), ref: 00AEB270
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: InputSendkeybd_event
                                                          • String ID:
                                                          • API String ID: 3536248340-0
                                                          • Opcode ID: 0e5dc09109001a7520f32620cc6b3709cea88dcd9a5467bbdb60d0a555c2a2e1
                                                          • Instruction ID: 61319686cab56b46569ad4ba33ad315c86924ce7a658fcaf326dad5630381ccb
                                                          • Opcode Fuzzy Hash: 0e5dc09109001a7520f32620cc6b3709cea88dcd9a5467bbdb60d0a555c2a2e1
                                                          • Instruction Fuzzy Hash: E4F01D7185428DABDB059FA1C806BEE7FB4FF04305F008009F965A6191C77986119FA4
                                                          Function 00AE10BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00AE11FC), ref: 00AE10D4
                                                          • CloseHandle.KERNEL32(?,?,00AE11FC), ref: 00AE10E9
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: AdjustCloseHandlePrivilegesToken
                                                          • String ID:
                                                          • API String ID: 81990902-0
                                                          • Opcode ID: fbccfd60232ddd568cabfa279a48670a4983763fff49c5ecf8bea5f4ffdfb2c1
                                                          • Instruction ID: 9081938c69fe2dd503b008352a19035cc8bd0b3bfba0a271510cfe69b4128066
                                                          • Opcode Fuzzy Hash: fbccfd60232ddd568cabfa279a48670a4983763fff49c5ecf8bea5f4ffdfb2c1
                                                          • Instruction Fuzzy Hash: B7E0BF72154610AFEB252B51FD09EB77BE9EB04310B24C82DF5A5814B1DB726C90DB54
                                                          Function 00A8CAF0 Relevance: 1.9, Strings: 1, Instructions: 659COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          • Variable is not of type 'Object'., xrefs: 00AD0C40
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: Variable is not of type 'Object'.
                                                          • API String ID: 0-1840281001
                                                          • Opcode ID: 734f1855d61c729895fc9b037d5fdda8a5b8daa20527d10a6e3d7f6c64f107e5
                                                          • Instruction ID: 2421e9ef46bf31b118aef2a658d247f8d2e2932c4e9c995e38817fc0536a48e2
                                                          • Opcode Fuzzy Hash: 734f1855d61c729895fc9b037d5fdda8a5b8daa20527d10a6e3d7f6c64f107e5
                                                          • Instruction Fuzzy Hash: 75328870900218DFDF14EF94D985BEDBBB5BF05318F14806AE806AB292DB75AE45CF60
                                                          Function 00AB676B Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          • RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00AB6766,?,?,00000008,?,?,00ABFEFE,00000000), ref: 00AB6998
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: ExceptionRaise
                                                          • String ID:
                                                          • API String ID: 3997070919-0
                                                          • Opcode ID: 12bef984b4ab182706006702ab22c3bbce86294f813a5abd93abe0d2210101d3
                                                          • Instruction ID: 160671e1170b19a4320203e91a1d1b925265550ec699a9206cf4fae5e03816e5
                                                          • Opcode Fuzzy Hash: 12bef984b4ab182706006702ab22c3bbce86294f813a5abd93abe0d2210101d3
                                                          • Instruction Fuzzy Hash: 53B13C726106089FDB15CF28C486BA57BF4FF45364F29865CE899CF2A2C739E991CB40
                                                          Function 00A9B119 Relevance: 1.8, Strings: 1, Instructions: 511COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID: 0-3916222277
                                                          • Opcode ID: b1cba6e7569677588b1b643648cc5afc5b5b88ee3987ca758300f807d47eef20
                                                          • Instruction ID: 0631869903f56784e7b3c6475d3f37f94b91e250edfb82566ddbdb6536389d65
                                                          • Opcode Fuzzy Hash: b1cba6e7569677588b1b643648cc5afc5b5b88ee3987ca758300f807d47eef20
                                                          • Instruction Fuzzy Hash: 58126D75A10229DBCF24CF58D9806EEB7F5FF48710F14819AE809EB255DB349A81DFA0
                                                          Function 00AFEAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • BlockInput.USER32(00000001), ref: 00AFEABD
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: BlockInput
                                                          • String ID:
                                                          • API String ID: 3456056419-0
                                                          • Opcode ID: 328a42b25f79e97a3c9d6f6bac3ee599497e31db378295745a474670c037834a
                                                          • Instruction ID: fda4c20d486e2f09378efa38786bf5c0ab2dde09f5a40b0022d0443a8d566bc7
                                                          • Opcode Fuzzy Hash: 328a42b25f79e97a3c9d6f6bac3ee599497e31db378295745a474670c037834a
                                                          • Instruction Fuzzy Hash: 71E01A312102049FD710EF99D804E9ABBE9AF987A0F408426FD4AC7261DB70A8408BA0
                                                          Function 00AA09D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,00AA03EE), ref: 00AA09DA
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: ExceptionFilterUnhandled
                                                          • String ID:
                                                          • API String ID: 3192549508-0
                                                          • Opcode ID: 4dc7be7a3a4dabee086e78310ec363755923758dc53211666dcb6ccf1e263271
                                                          • Instruction ID: 7fe7c3d36912501d4df602322a8e1ab339a458c759d7d57127d6181e343f5337
                                                          • Opcode Fuzzy Hash: 4dc7be7a3a4dabee086e78310ec363755923758dc53211666dcb6ccf1e263271
                                                          • Instruction Fuzzy Hash:
                                                          Function 00AA781B Relevance: 1.5, Strings: 1, Instructions: 214COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: 0
                                                          • API String ID: 0-4108050209
                                                          • Opcode ID: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
                                                          • Instruction ID: 36071676543707f8f74878427c837d6691ef61e1d017ca905ae6f8476c02bf0f
                                                          • Opcode Fuzzy Hash: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
                                                          • Instruction Fuzzy Hash: 5551557260C7056BDB3887688D5EBBF63A99B0B340F18051BD886D72C2CB1DDE85D356
                                                          Function 00AB6DD9 Relevance: .6, Instructions: 637COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 95ee080141789b6b802c942246ef3edc073ae1d853912c57b0a76b69b3789f3e
                                                          • Instruction ID: 2cccfcec255029e85f56d26afc1bac7bf817e3db9d046ed82912cf5df2423e46
                                                          • Opcode Fuzzy Hash: 95ee080141789b6b802c942246ef3edc073ae1d853912c57b0a76b69b3789f3e
                                                          • Instruction Fuzzy Hash: AB320022D29F414DD7339634C822339A65DAFB73C5F15D737E81AB69AAEF69C4834100
                                                          Function 00A9CC39 Relevance: .6, Instructions: 635COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 61a63bb8b4adcfff60ba35267b64d96007e5cab59dd6070381b01fa1f638f80b
                                                          • Instruction ID: f7302250b88250565732704f09020a26930520a079ddf4bef231cee01807d756
                                                          • Opcode Fuzzy Hash: 61a63bb8b4adcfff60ba35267b64d96007e5cab59dd6070381b01fa1f638f80b
                                                          • Instruction Fuzzy Hash: 9432E131B401168BDF28CB69C4946BD7BF2EB45330FA8856BD49B9B392D634DE81DB40
                                                          Function 00A87920 Relevance: .6, Instructions: 563COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: cb22ba4ab10ad03b5a6613b04f6f5343f8339ab054421c01e8d243f70b46988c
                                                          • Instruction ID: 1f513b970b14c9cefb652aacb93709e7d4488baed12615294f9b45d008960ba5
                                                          • Opcode Fuzzy Hash: cb22ba4ab10ad03b5a6613b04f6f5343f8339ab054421c01e8d243f70b46988c
                                                          • Instruction Fuzzy Hash: BF228F70E046099FDF14DFA5C981BAEB7F6FF44300F244529E816AB291EB35E951CB50
                                                          Function 00A891C0 Relevance: .5, Instructions: 475COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: fd6261bc37a9c347e6d34f7b11f88e13663a304c737b3f6712c4729c4dc2539e
                                                          • Instruction ID: 51b4c00f11c00933c3ae81e48db03469c54e59f413f57b477c2b2788b431d99b
                                                          • Opcode Fuzzy Hash: fd6261bc37a9c347e6d34f7b11f88e13663a304c737b3f6712c4729c4dc2539e
                                                          • Instruction Fuzzy Hash: F70280B1A0020AEFDF04DF54D981BAEB7F1FF44340F158169E816DB291EB31AA21CB95
                                                          Function 00AB9EEE Relevance: .3, Instructions: 294COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: d9a741f98128e3f170f3c25c4e2ad1c575ff62b1df76b115259c6a460a5fe445
                                                          • Instruction ID: a93be53529e9004efe11b325dd427d76790308967ac044447f059c02d66dfd55
                                                          • Opcode Fuzzy Hash: d9a741f98128e3f170f3c25c4e2ad1c575ff62b1df76b115259c6a460a5fe445
                                                          • Instruction Fuzzy Hash: DFB1F220D2AF414DD32396398871336B69CAFBB6D5F91D71BFC2675D22EF2686834140
                                                          Function 00AA1C77 Relevance: .3, Instructions: 254COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
                                                          • Instruction ID: 4e36eb484c560cbb63633f516119c626051bcc5d79c30b1d7cb7cb93eedef793
                                                          • Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
                                                          • Instruction Fuzzy Hash: 569153726080A35ADB29473A857407EFFE15A933B2B1A079ED4F2CB1C5FF249964D620
                                                          Function 00AA1F32 Relevance: .2, Instructions: 244COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
                                                          • Instruction ID: 5e829aecc28e684111fe55ee5fd4f9fcfc46f005b644cf1a9b16d502cac15660
                                                          • Opcode Fuzzy Hash: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
                                                          • Instruction Fuzzy Hash: EF912F722090A34EDB69473D857453EFFE15A933A171A079EE4F2CB1C5EF248964E720
                                                          Function 00AA19B0 Relevance: .2, Instructions: 240COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
                                                          • Instruction ID: 96d52092c10e8c1ab45088d8743351ec65cf85cf093652d2eb3d7e33c3889cdc
                                                          • Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
                                                          • Instruction Fuzzy Hash: 549130722090A35EDB69477A857403EFFF15A933A2B1A079ED4F2CB1C1FF248965D620
                                                          Function 00AA7A4A Relevance: .2, Instructions: 237COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: ebf312025fd685482e07da92bcadefc8b07612218551987a7ef8ca380c887fb1
                                                          • Instruction ID: 27f845dc10b4906fc426ee2810f3034d68a0585c799b5820c95135d1b2c08dd0
                                                          • Opcode Fuzzy Hash: ebf312025fd685482e07da92bcadefc8b07612218551987a7ef8ca380c887fb1
                                                          • Instruction Fuzzy Hash: F96137B1708709A6DE349B288D95BBF63A8DF43750F24091AE843DB2C1DB159E42C775
                                                          Function 00AA7CA7 Relevance: .2, Instructions: 237COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 0de080297a5409d978f6569f19a908afe248f3a4ecbd8095941aeb785e659bbe
                                                          • Instruction ID: 447c52a392f2bf35b438ffcdc35c8f3f7e386d4dfbedc3361b3748c028e9deaf
                                                          • Opcode Fuzzy Hash: 0de080297a5409d978f6569f19a908afe248f3a4ecbd8095941aeb785e659bbe
                                                          • Instruction Fuzzy Hash: A661997160870967DF388B288DA5BBF63A8EF43704F14095AE943DB2C1EB16ED428B55
                                                          Function 00AA1706 Relevance: .2, Instructions: 232COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
                                                          • Instruction ID: f3064c1ef404cf326a88a49b6cc334b914c53b16a87077993816bddc45391849
                                                          • Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
                                                          • Instruction Fuzzy Hash: 848174726090A31DDB6D473A857443EFFE15A933A1B1A079DD4F2CB1C1EF24C954E620
                                                          Function 00A9D063 Relevance: .1, Instructions: 134COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 258c31b98c21070db14766f0e04f80bb9f7ca5d19298dc7472ee0d830283b858
                                                          • Instruction ID: 0b40acc8305f8a9403fc51106febde4f8529244de17a77a5ac17b760e15b7156
                                                          • Opcode Fuzzy Hash: 258c31b98c21070db14766f0e04f80bb9f7ca5d19298dc7472ee0d830283b858
                                                          • Instruction Fuzzy Hash: 75512A9985FBDA1FDB179734886A198FFB0AC1726174887CFD8825E8CBD381041AC75B
                                                          Function 00AF2046 Relevance: .1, Instructions: 72COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 284c4cdcf42df3814828f3ca44ad4ee68e879d544a6254c94109ab6f711dac70
                                                          • Instruction ID: ff8ae548ba247c5f1dbd8e70ac8d45b9f1502eab957b2bb6343cb0f9cd3f8453
                                                          • Opcode Fuzzy Hash: 284c4cdcf42df3814828f3ca44ad4ee68e879d544a6254c94109ab6f711dac70
                                                          • Instruction Fuzzy Hash: B521A5326216158BDB28CF79C82277A73E5A764311F15866EE4A7C37D0DE39AD04CB80
                                                          Function 00B02ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • DeleteObject.GDI32(00000000), ref: 00B02B30
                                                          • DeleteObject.GDI32(00000000), ref: 00B02B43
                                                          • DestroyWindow.USER32 ref: 00B02B52
                                                          • GetDesktopWindow.USER32 ref: 00B02B6D
                                                          • GetWindowRect.USER32(00000000), ref: 00B02B74
                                                          • SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00B02CA3
                                                          • AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00B02CB1
                                                          • CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B02CF8
                                                          • GetClientRect.USER32(00000000,?), ref: 00B02D04
                                                          • CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00B02D40
                                                          • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B02D62
                                                          • GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B02D75
                                                          • GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B02D80
                                                          • GlobalLock.KERNEL32(00000000), ref: 00B02D89
                                                          • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B02D98
                                                          • GlobalUnlock.KERNEL32(00000000), ref: 00B02DA1
                                                          • CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B02DA8
                                                          • GlobalFree.KERNEL32(00000000), ref: 00B02DB3
                                                          • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B02DC5
                                                          • OleLoadPicture.OLEAUT32(?,00000000,00000000,00B1FC38,00000000), ref: 00B02DDB
                                                          • GlobalFree.KERNEL32(00000000), ref: 00B02DEB
                                                          • CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00B02E11
                                                          • SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00B02E30
                                                          • SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B02E52
                                                          • ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B0303F
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
                                                          • String ID: $AutoIt v3$DISPLAY$static
                                                          • API String ID: 2211948467-2373415609
                                                          • Opcode ID: 4be34078b4bc6f0c90c18eac45af2728118c252187ddd736e904d7701c257b78
                                                          • Instruction ID: 114e6cd75076a1fa9b2eedb53aa4ff41fe7ef931a7424e0efc35b3106dfc52b2
                                                          • Opcode Fuzzy Hash: 4be34078b4bc6f0c90c18eac45af2728118c252187ddd736e904d7701c257b78
                                                          • Instruction Fuzzy Hash: 93028A71940205AFDB14DFA4CD89EAE7FB9FB49711F108598F915AB2A1DB70ED00CB60
                                                          Function 00B170D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SetTextColor.GDI32(?,00000000), ref: 00B1712F
                                                          • GetSysColorBrush.USER32(0000000F), ref: 00B17160
                                                          • GetSysColor.USER32(0000000F), ref: 00B1716C
                                                          • SetBkColor.GDI32(?,000000FF), ref: 00B17186
                                                          • SelectObject.GDI32(?,?), ref: 00B17195
                                                          • InflateRect.USER32(?,000000FF,000000FF), ref: 00B171C0
                                                          • GetSysColor.USER32(00000010), ref: 00B171C8
                                                          • CreateSolidBrush.GDI32(00000000), ref: 00B171CF
                                                          • FrameRect.USER32(?,?,00000000), ref: 00B171DE
                                                          • DeleteObject.GDI32(00000000), ref: 00B171E5
                                                          • InflateRect.USER32(?,000000FE,000000FE), ref: 00B17230
                                                          • FillRect.USER32(?,?,?), ref: 00B17262
                                                          • GetWindowLongW.USER32(?,000000F0), ref: 00B17284
                                                            • Part of subcall function 00B173E8: GetSysColor.USER32(00000012), ref: 00B17421
                                                            • Part of subcall function 00B173E8: SetTextColor.GDI32(?,?), ref: 00B17425
                                                            • Part of subcall function 00B173E8: GetSysColorBrush.USER32(0000000F), ref: 00B1743B
                                                            • Part of subcall function 00B173E8: GetSysColor.USER32(0000000F), ref: 00B17446
                                                            • Part of subcall function 00B173E8: GetSysColor.USER32(00000011), ref: 00B17463
                                                            • Part of subcall function 00B173E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00B17471
                                                            • Part of subcall function 00B173E8: SelectObject.GDI32(?,00000000), ref: 00B17482
                                                            • Part of subcall function 00B173E8: SetBkColor.GDI32(?,00000000), ref: 00B1748B
                                                            • Part of subcall function 00B173E8: SelectObject.GDI32(?,?), ref: 00B17498
                                                            • Part of subcall function 00B173E8: InflateRect.USER32(?,000000FF,000000FF), ref: 00B174B7
                                                            • Part of subcall function 00B173E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00B174CE
                                                            • Part of subcall function 00B173E8: GetWindowLongW.USER32(00000000,000000F0), ref: 00B174DB
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
                                                          • String ID:
                                                          • API String ID: 4124339563-0
                                                          • Opcode ID: 0fdbb45bb9256d78adf3454ce13e9b4155b9de03d6438633a7ee8e2e5baed45a
                                                          • Instruction ID: 67a98e6c50c074cbc8980a448beced26829d9f7290243ed250c0af910e11ddac
                                                          • Opcode Fuzzy Hash: 0fdbb45bb9256d78adf3454ce13e9b4155b9de03d6438633a7ee8e2e5baed45a
                                                          • Instruction Fuzzy Hash: 97A18E72088301FFDB019F60DC48A9A7BF9FB49320F904A19F962A71A1DB70E9458B91
                                                          Function 00A98D85 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • DestroyWindow.USER32(?,?), ref: 00A98E14
                                                          • SendMessageW.USER32(?,00001308,?,00000000), ref: 00AD6AC5
                                                          • ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00AD6AFE
                                                          • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00AD6F43
                                                            • Part of subcall function 00A98F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00A98BE8,?,00000000,?,?,?,?,00A98BBA,00000000,?), ref: 00A98FC5
                                                          • SendMessageW.USER32(?,00001053), ref: 00AD6F7F
                                                          • SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00AD6F96
                                                          • ImageList_Destroy.COMCTL32(00000000,?), ref: 00AD6FAC
                                                          • ImageList_Destroy.COMCTL32(00000000,?), ref: 00AD6FB7
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
                                                          • String ID: 0
                                                          • API String ID: 2760611726-4108050209
                                                          • Opcode ID: cb2483d5b6115b5d6543f3e5b04dccfb840690307f0985d43e11a8c42e384042
                                                          • Instruction ID: 2a0e38c1869611c395d7a9e4d0ee0e79f2711b21d637197e988245edd346806f
                                                          • Opcode Fuzzy Hash: cb2483d5b6115b5d6543f3e5b04dccfb840690307f0985d43e11a8c42e384042
                                                          • Instruction Fuzzy Hash: CC12AD30600611DFDB25CF28D994BAABBF5FB49301F54846AF4968B261CB35EC52CB91
                                                          Function 00B02711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • DestroyWindow.USER32(00000000), ref: 00B0273E
                                                          • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00B0286A
                                                          • SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 00B028A9
                                                          • AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 00B028B9
                                                          • CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00B02900
                                                          • GetClientRect.USER32(00000000,?), ref: 00B0290C
                                                          • CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 00B02955
                                                          • CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00B02964
                                                          • GetStockObject.GDI32(00000011), ref: 00B02974
                                                          • SelectObject.GDI32(00000000,00000000), ref: 00B02978
                                                          • GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00B02988
                                                          • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00B02991
                                                          • DeleteDC.GDI32(00000000), ref: 00B0299A
                                                          • CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00B029C6
                                                          • SendMessageW.USER32(00000030,00000000,00000001), ref: 00B029DD
                                                          • CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00B02A1D
                                                          • SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00B02A31
                                                          • SendMessageW.USER32(00000404,00000001,00000000), ref: 00B02A42
                                                          • CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 00B02A77
                                                          • GetStockObject.GDI32(00000011), ref: 00B02A82
                                                          • SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00B02A8D
                                                          • ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00B02A97
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
                                                          • String ID: AutoIt v3$DISPLAY$msctls_progress32$static
                                                          • API String ID: 2910397461-517079104
                                                          • Opcode ID: 5f767fc5a62092cdf3d4206eca6d3c4e67c98b84da7feb3cd4439abc359f9ade
                                                          • Instruction ID: b0e68b093fa5918c586f4fed15160483d76e85cb7301fafc6201f1eb26616f2b
                                                          • Opcode Fuzzy Hash: 5f767fc5a62092cdf3d4206eca6d3c4e67c98b84da7feb3cd4439abc359f9ade
                                                          • Instruction Fuzzy Hash: BCB14971A40215BFEB14DFA8CD89FAE7BB9EB08711F108554F915E72A0DB70AD40CBA4
                                                          Function 00AF4ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SetErrorMode.KERNEL32(00000001), ref: 00AF4AED
                                                          • GetDriveTypeW.KERNEL32(?,00B1CB68,?,\\.\,00B1CC08), ref: 00AF4BCA
                                                          • SetErrorMode.KERNEL32(00000000,00B1CB68,?,\\.\,00B1CC08), ref: 00AF4D36
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: ErrorMode$DriveType
                                                          • String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
                                                          • API String ID: 2907320926-4222207086
                                                          • Opcode ID: 85a8120173ab2d3a797613af03d81fc28dbbba477c88595718beb95cc3163432
                                                          • Instruction ID: 5c7d31d69e6bdf5435c16c32d068931689cad9e41a63c4203d512441a16b6797
                                                          • Opcode Fuzzy Hash: 85a8120173ab2d3a797613af03d81fc28dbbba477c88595718beb95cc3163432
                                                          • Instruction Fuzzy Hash: 7E61D430A4520D9BCB04DFA4CA8197E77F0EB4D714B249065F906AB262DB35DE42EB52
                                                          Function 00B173E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetSysColor.USER32(00000012), ref: 00B17421
                                                          • SetTextColor.GDI32(?,?), ref: 00B17425
                                                          • GetSysColorBrush.USER32(0000000F), ref: 00B1743B
                                                          • GetSysColor.USER32(0000000F), ref: 00B17446
                                                          • CreateSolidBrush.GDI32(?), ref: 00B1744B
                                                          • GetSysColor.USER32(00000011), ref: 00B17463
                                                          • CreatePen.GDI32(00000000,00000001,00743C00), ref: 00B17471
                                                          • SelectObject.GDI32(?,00000000), ref: 00B17482
                                                          • SetBkColor.GDI32(?,00000000), ref: 00B1748B
                                                          • SelectObject.GDI32(?,?), ref: 00B17498
                                                          • InflateRect.USER32(?,000000FF,000000FF), ref: 00B174B7
                                                          • RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00B174CE
                                                          • GetWindowLongW.USER32(00000000,000000F0), ref: 00B174DB
                                                          • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00B1752A
                                                          • GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00B17554
                                                          • InflateRect.USER32(?,000000FD,000000FD), ref: 00B17572
                                                          • DrawFocusRect.USER32(?,?), ref: 00B1757D
                                                          • GetSysColor.USER32(00000011), ref: 00B1758E
                                                          • SetTextColor.GDI32(?,00000000), ref: 00B17596
                                                          • DrawTextW.USER32(?,00B170F5,000000FF,?,00000000), ref: 00B175A8
                                                          • SelectObject.GDI32(?,?), ref: 00B175BF
                                                          • DeleteObject.GDI32(?), ref: 00B175CA
                                                          • SelectObject.GDI32(?,?), ref: 00B175D0
                                                          • DeleteObject.GDI32(?), ref: 00B175D5
                                                          • SetTextColor.GDI32(?,?), ref: 00B175DB
                                                          • SetBkColor.GDI32(?,?), ref: 00B175E5
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
                                                          • String ID:
                                                          • API String ID: 1996641542-0
                                                          • Opcode ID: 87ccfeae3265ecb5d5b5a20ea8f8e1089733a109b7632a943e3c34a13e59f59f
                                                          • Instruction ID: 20c9c8fa4ffc88904643ec9b3ad3a3364225fb471cbfa23273ce1911398c66c0
                                                          • Opcode Fuzzy Hash: 87ccfeae3265ecb5d5b5a20ea8f8e1089733a109b7632a943e3c34a13e59f59f
                                                          • Instruction Fuzzy Hash: 02615D72984218FFDF019FA4DC49AEE7FB9EB08320F618155F915BB2A1DB749940CB90
                                                          Function 00B10FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetCursorPos.USER32(?), ref: 00B11128
                                                          • GetDesktopWindow.USER32 ref: 00B1113D
                                                          • GetWindowRect.USER32(00000000), ref: 00B11144
                                                          • GetWindowLongW.USER32(?,000000F0), ref: 00B11199
                                                          • DestroyWindow.USER32(?), ref: 00B111B9
                                                          • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00B111ED
                                                          • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00B1120B
                                                          • SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00B1121D
                                                          • SendMessageW.USER32(00000000,00000421,?,?), ref: 00B11232
                                                          • SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00B11245
                                                          • IsWindowVisible.USER32(00000000), ref: 00B112A1
                                                          • SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 00B112BC
                                                          • SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 00B112D0
                                                          • GetWindowRect.USER32(00000000,?), ref: 00B112E8
                                                          • MonitorFromPoint.USER32(?,?,00000002), ref: 00B1130E
                                                          • GetMonitorInfoW.USER32(00000000,?), ref: 00B11328
                                                          • CopyRect.USER32(?,?), ref: 00B1133F
                                                          • SendMessageW.USER32(00000000,00000412,00000000), ref: 00B113AA
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
                                                          • String ID: ($0$tooltips_class32
                                                          • API String ID: 698492251-4156429822
                                                          • Opcode ID: 61546cc84ab6ce67390fc6e5fed97a534542c60d0ea1000c209956d57b5879a9
                                                          • Instruction ID: 36c76d7c6fe2e35d55136b50c7b14d2c49946b01c6232ddb803493fd5f7228a2
                                                          • Opcode Fuzzy Hash: 61546cc84ab6ce67390fc6e5fed97a534542c60d0ea1000c209956d57b5879a9
                                                          • Instruction Fuzzy Hash: 5AB19E71604341AFD704DF68C985BAEBBE4FF88750F408958FA999B2A1CB31DC44CBA1
                                                          Function 00A98891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00A98968
                                                          • GetSystemMetrics.USER32(00000007), ref: 00A98970
                                                          • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00A9899B
                                                          • GetSystemMetrics.USER32(00000008), ref: 00A989A3
                                                          • GetSystemMetrics.USER32(00000004), ref: 00A989C8
                                                          • SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00A989E5
                                                          • AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00A989F5
                                                          • CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00A98A28
                                                          • SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00A98A3C
                                                          • GetClientRect.USER32(00000000,000000FF), ref: 00A98A5A
                                                          • GetStockObject.GDI32(00000011), ref: 00A98A76
                                                          • SendMessageW.USER32(00000000,00000030,00000000), ref: 00A98A81
                                                            • Part of subcall function 00A9912D: GetCursorPos.USER32(?), ref: 00A99141
                                                            • Part of subcall function 00A9912D: ScreenToClient.USER32(00000000,?), ref: 00A9915E
                                                            • Part of subcall function 00A9912D: GetAsyncKeyState.USER32(00000001), ref: 00A99183
                                                            • Part of subcall function 00A9912D: GetAsyncKeyState.USER32(00000002), ref: 00A9919D
                                                          • SetTimer.USER32(00000000,00000000,00000028,00A990FC), ref: 00A98AA8
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
                                                          • String ID: AutoIt v3 GUI
                                                          • API String ID: 1458621304-248962490
                                                          • Opcode ID: cbb68c01de623015d40f64880b3e00c46bcdd138b521046526d7ad059d4ea7f4
                                                          • Instruction ID: 7f5d2e9f72d1df0a4983efe84fbd597f26768798f4b8c47dc79b7b0c5b4b082a
                                                          • Opcode Fuzzy Hash: cbb68c01de623015d40f64880b3e00c46bcdd138b521046526d7ad059d4ea7f4
                                                          • Instruction Fuzzy Hash: E7B16C71A40209AFDF14DFA8CD45BEE3BF5FB48315F10856AFA16A7290DB34A841CB50
                                                          Function 00AE0D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00AE10F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00AE1114
                                                            • Part of subcall function 00AE10F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00AE0B9B,?,?,?), ref: 00AE1120
                                                            • Part of subcall function 00AE10F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00AE0B9B,?,?,?), ref: 00AE112F
                                                            • Part of subcall function 00AE10F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00AE0B9B,?,?,?), ref: 00AE1136
                                                            • Part of subcall function 00AE10F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00AE114D
                                                          • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00AE0DF5
                                                          • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00AE0E29
                                                          • GetLengthSid.ADVAPI32(?), ref: 00AE0E40
                                                          • GetAce.ADVAPI32(?,00000000,?), ref: 00AE0E7A
                                                          • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00AE0E96
                                                          • GetLengthSid.ADVAPI32(?), ref: 00AE0EAD
                                                          • GetProcessHeap.KERNEL32(00000008,00000008), ref: 00AE0EB5
                                                          • HeapAlloc.KERNEL32(00000000), ref: 00AE0EBC
                                                          • GetLengthSid.ADVAPI32(?,00000008,?), ref: 00AE0EDD
                                                          • CopySid.ADVAPI32(00000000), ref: 00AE0EE4
                                                          • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00AE0F13
                                                          • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00AE0F35
                                                          • SetUserObjectSecurity.USER32(?,00000004,?), ref: 00AE0F47
                                                          • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00AE0F6E
                                                          • HeapFree.KERNEL32(00000000), ref: 00AE0F75
                                                          • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00AE0F7E
                                                          • HeapFree.KERNEL32(00000000), ref: 00AE0F85
                                                          • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00AE0F8E
                                                          • HeapFree.KERNEL32(00000000), ref: 00AE0F95
                                                          • GetProcessHeap.KERNEL32(00000000,?), ref: 00AE0FA1
                                                          • HeapFree.KERNEL32(00000000), ref: 00AE0FA8
                                                            • Part of subcall function 00AE1193: GetProcessHeap.KERNEL32(00000008,00AE0BB1,?,00000000,?,00AE0BB1,?), ref: 00AE11A1
                                                            • Part of subcall function 00AE1193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00AE0BB1,?), ref: 00AE11A8
                                                            • Part of subcall function 00AE1193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00AE0BB1,?), ref: 00AE11B7
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
                                                          • String ID:
                                                          • API String ID: 4175595110-0
                                                          • Opcode ID: 580e6f562cc295c66c843e4d46a42da7f810d4f0c1a15c65fd50a88fd5b766b7
                                                          • Instruction ID: 5580bcdc49d0f757909d8c1cebcad1b28946db06283d7b4ae86d51dd22fd186a
                                                          • Opcode Fuzzy Hash: 580e6f562cc295c66c843e4d46a42da7f810d4f0c1a15c65fd50a88fd5b766b7
                                                          • Instruction Fuzzy Hash: CA717B7294024AABDB209FA5DC48FEEBBB8BF08300F148115F959E7191DB709E55CB60
                                                          Function 00B0C3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00B0C4BD
                                                          • RegCreateKeyExW.ADVAPI32(?,?,00000000,00B1CC08,00000000,?,00000000,?,?), ref: 00B0C544
                                                          • RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 00B0C5A4
                                                          • _wcslen.LIBCMT ref: 00B0C5F4
                                                          • _wcslen.LIBCMT ref: 00B0C66F
                                                          • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 00B0C6B2
                                                          • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 00B0C7C1
                                                          • RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 00B0C84D
                                                          • RegCloseKey.ADVAPI32(?), ref: 00B0C881
                                                          • RegCloseKey.ADVAPI32(00000000), ref: 00B0C88E
                                                          • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 00B0C960
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Value$Close$_wcslen$ConnectCreateRegistry
                                                          • String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
                                                          • API String ID: 9721498-966354055
                                                          • Opcode ID: 730ccc2e3c724ae7dfe14ad2ce0b1207e2773560d560cb2c38791f7149b6adee
                                                          • Instruction ID: ca5ab5113f6a5354c19319ee68ccea4a9315b43483174edfa740231d19ae225d
                                                          • Opcode Fuzzy Hash: 730ccc2e3c724ae7dfe14ad2ce0b1207e2773560d560cb2c38791f7149b6adee
                                                          • Instruction Fuzzy Hash: 181269356042019FDB14EF14C981A2ABBE5FF88714F14899CF89A9B3A2DB31FD41CB95
                                                          Function 00B1091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CharUpperBuffW.USER32(?,?), ref: 00B109C6
                                                          • _wcslen.LIBCMT ref: 00B10A01
                                                          • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00B10A54
                                                          • _wcslen.LIBCMT ref: 00B10A8A
                                                          • _wcslen.LIBCMT ref: 00B10B06
                                                          • _wcslen.LIBCMT ref: 00B10B81
                                                            • Part of subcall function 00A9F9F2: _wcslen.LIBCMT ref: 00A9F9FD
                                                            • Part of subcall function 00AE2BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00AE2BFA
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: _wcslen$MessageSend$BuffCharUpper
                                                          • String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
                                                          • API String ID: 1103490817-4258414348
                                                          • Opcode ID: 0e269150fd342cf76365a0d2f9f27fca3bfe8d5a49fb774ac847393a8305c68b
                                                          • Instruction ID: 0d91e5beded7437b4d56776ff64acdfc1b132441ba983bb82e9cfbe63e362c70
                                                          • Opcode Fuzzy Hash: 0e269150fd342cf76365a0d2f9f27fca3bfe8d5a49fb774ac847393a8305c68b
                                                          • Instruction Fuzzy Hash: 3BE1AF312283418FCB14EF24C59096AB7E1FF98314F94899DF8969B362DB70ED85CB91
                                                          Function 00B0C998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: _wcslen$BuffCharUpper
                                                          • String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
                                                          • API String ID: 1256254125-909552448
                                                          • Opcode ID: 782b0024cbd1fc9c6cb47b2810e48cc5fc2768cb721c49f9bdded7a34ec4f72c
                                                          • Instruction ID: f61031300e11efba1ca26e588e472f23d4fae8c92f01c0ecb75d87bb3eccf6f6
                                                          • Opcode Fuzzy Hash: 782b0024cbd1fc9c6cb47b2810e48cc5fc2768cb721c49f9bdded7a34ec4f72c
                                                          • Instruction Fuzzy Hash: 2871E13360016A8BDB20DF6CC9415BB3FD5EBA1750B6507A8F866972D8EB30CE45D3A0
                                                          Function 00B1833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • _wcslen.LIBCMT ref: 00B1835A
                                                          • _wcslen.LIBCMT ref: 00B1836E
                                                          • _wcslen.LIBCMT ref: 00B18391
                                                          • _wcslen.LIBCMT ref: 00B183B4
                                                          • LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00B183F2
                                                          • LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,00B1361A,?), ref: 00B1844E
                                                          • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00B18487
                                                          • LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00B184CA
                                                          • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00B18501
                                                          • FreeLibrary.KERNEL32(?), ref: 00B1850D
                                                          • ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00B1851D
                                                          • DestroyIcon.USER32(?), ref: 00B1852C
                                                          • SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00B18549
                                                          • SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00B18555
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
                                                          • String ID: .dll$.exe$.icl
                                                          • API String ID: 799131459-1154884017
                                                          • Opcode ID: 6b9e146e384dca60765044d0ad9f27ea82be78c2dbbd3cee56ff4e67cb8e4922
                                                          • Instruction ID: 29e6ed438dbe608c480323990dcc36ac5822c26489e369eab03f4ee408bde6b4
                                                          • Opcode Fuzzy Hash: 6b9e146e384dca60765044d0ad9f27ea82be78c2dbbd3cee56ff4e67cb8e4922
                                                          • Instruction Fuzzy Hash: EB61CF71540205BAEB14DF64DC81BFE7BA8FB18B11F508649F815D71D1DFB4AA90CBA0
                                                          Function 00A87778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
                                                          • API String ID: 0-1645009161
                                                          • Opcode ID: 3d6c0787845a14dbd1b514643656b5d876c72e0ddd63896133a600b909e1ec1c
                                                          • Instruction ID: 6b4dcbba685b4aae6d6ef73fdf8841f87a23eeb22aecdf7522661659f3f08898
                                                          • Opcode Fuzzy Hash: 3d6c0787845a14dbd1b514643656b5d876c72e0ddd63896133a600b909e1ec1c
                                                          • Instruction Fuzzy Hash: 9C81D071A44605BBDB20BF60CD42FAF7BB8AF15300F154068F805AB1D6EB74EA91C7A1
                                                          Function 00AF3E79 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 205COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CharLowerBuffW.USER32(?,?), ref: 00AF3EF8
                                                          • _wcslen.LIBCMT ref: 00AF3F03
                                                          • _wcslen.LIBCMT ref: 00AF3F5A
                                                          • _wcslen.LIBCMT ref: 00AF3F98
                                                          • GetDriveTypeW.KERNEL32(?), ref: 00AF3FD6
                                                          • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00AF401E
                                                          • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00AF4059
                                                          • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00AF4087
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: SendString_wcslen$BuffCharDriveLowerType
                                                          • String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
                                                          • API String ID: 1839972693-4113822522
                                                          • Opcode ID: 02ce18d7ca4d04462a49f861ade83d91702b28cce1ceab91d1775d75a4684af6
                                                          • Instruction ID: b9e938064f59cbf9ed921c97bd564fad0dc61479abd496abb8357e2b3859fa43
                                                          • Opcode Fuzzy Hash: 02ce18d7ca4d04462a49f861ade83d91702b28cce1ceab91d1775d75a4684af6
                                                          • Instruction Fuzzy Hash: F171CD32A042069FC710EF24C98197BB7F4EF99758F00492DFA9697261EB30DE45CB92
                                                          Function 00AE5A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • LoadIconW.USER32(00000063), ref: 00AE5A2E
                                                          • SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00AE5A40
                                                          • SetWindowTextW.USER32(?,?), ref: 00AE5A57
                                                          • GetDlgItem.USER32(?,000003EA), ref: 00AE5A6C
                                                          • SetWindowTextW.USER32(00000000,?), ref: 00AE5A72
                                                          • GetDlgItem.USER32(?,000003E9), ref: 00AE5A82
                                                          • SetWindowTextW.USER32(00000000,?), ref: 00AE5A88
                                                          • SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00AE5AA9
                                                          • SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00AE5AC3
                                                          • GetWindowRect.USER32(?,?), ref: 00AE5ACC
                                                          • _wcslen.LIBCMT ref: 00AE5B33
                                                          • SetWindowTextW.USER32(?,?), ref: 00AE5B6F
                                                          • GetDesktopWindow.USER32 ref: 00AE5B75
                                                          • GetWindowRect.USER32(00000000), ref: 00AE5B7C
                                                          • MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00AE5BD3
                                                          • GetClientRect.USER32(?,?), ref: 00AE5BE0
                                                          • PostMessageW.USER32(?,00000005,00000000,?), ref: 00AE5C05
                                                          • SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00AE5C2F
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
                                                          • String ID:
                                                          • API String ID: 895679908-0
                                                          • Opcode ID: d69c05e5c3708ba00e86ebb76acd45ac9aa233596fd33451fd400d0ab00a630e
                                                          • Instruction ID: c3ed702d0f3d9a3039073a7642d0487925b6fb6e64666b79552a15f56a423bcf
                                                          • Opcode Fuzzy Hash: d69c05e5c3708ba00e86ebb76acd45ac9aa233596fd33451fd400d0ab00a630e
                                                          • Instruction Fuzzy Hash: 4A715D31900B49AFDB20DFB9DE85AAEBBF5FF48708F104518E542A35A0DB75E944CB50
                                                          Function 00AFFE0E Relevance: 27.1, APIs: 18, Instructions: 128COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • LoadCursorW.USER32(00000000,00007F89), ref: 00AFFE27
                                                          • LoadCursorW.USER32(00000000,00007F8A), ref: 00AFFE32
                                                          • LoadCursorW.USER32(00000000,00007F00), ref: 00AFFE3D
                                                          • LoadCursorW.USER32(00000000,00007F03), ref: 00AFFE48
                                                          • LoadCursorW.USER32(00000000,00007F8B), ref: 00AFFE53
                                                          • LoadCursorW.USER32(00000000,00007F01), ref: 00AFFE5E
                                                          • LoadCursorW.USER32(00000000,00007F81), ref: 00AFFE69
                                                          • LoadCursorW.USER32(00000000,00007F88), ref: 00AFFE74
                                                          • LoadCursorW.USER32(00000000,00007F80), ref: 00AFFE7F
                                                          • LoadCursorW.USER32(00000000,00007F86), ref: 00AFFE8A
                                                          • LoadCursorW.USER32(00000000,00007F83), ref: 00AFFE95
                                                          • LoadCursorW.USER32(00000000,00007F85), ref: 00AFFEA0
                                                          • LoadCursorW.USER32(00000000,00007F82), ref: 00AFFEAB
                                                          • LoadCursorW.USER32(00000000,00007F84), ref: 00AFFEB6
                                                          • LoadCursorW.USER32(00000000,00007F04), ref: 00AFFEC1
                                                          • LoadCursorW.USER32(00000000,00007F02), ref: 00AFFECC
                                                          • GetCursorInfo.USER32(?), ref: 00AFFEDC
                                                          • GetLastError.KERNEL32 ref: 00AFFF1E
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Cursor$Load$ErrorInfoLast
                                                          • String ID:
                                                          • API String ID: 3215588206-0
                                                          • Opcode ID: 6d15f25c2c41ccaee6fb90310c070c3be2ec058f426e0eb6fef4479af3602b17
                                                          • Instruction ID: 4379941068ccfc1d76dfbb101ac3fab2477320f40f762b4872c3d35bfed16523
                                                          • Opcode Fuzzy Hash: 6d15f25c2c41ccaee6fb90310c070c3be2ec058f426e0eb6fef4479af3602b17
                                                          • Instruction Fuzzy Hash: 914144B0D443196EDB109FBA8C8586EBFE8FF04754B50852AF11DE7291DB789901CF91
                                                          Function 00AA00C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • __scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 00AA00C6
                                                            • Part of subcall function 00AA00ED: InitializeCriticalSectionAndSpinCount.KERNEL32(00B5070C,00000FA0,8DE1778D,?,?,?,?,00AC23B3,000000FF), ref: 00AA011C
                                                            • Part of subcall function 00AA00ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,00AC23B3,000000FF), ref: 00AA0127
                                                            • Part of subcall function 00AA00ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,00AC23B3,000000FF), ref: 00AA0138
                                                            • Part of subcall function 00AA00ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 00AA014E
                                                            • Part of subcall function 00AA00ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00AA015C
                                                            • Part of subcall function 00AA00ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00AA016A
                                                            • Part of subcall function 00AA00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00AA0195
                                                            • Part of subcall function 00AA00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00AA01A0
                                                          • ___scrt_fastfail.LIBCMT ref: 00AA00E7
                                                            • Part of subcall function 00AA00A3: __onexit.LIBCMT ref: 00AA00A9
                                                          Strings
                                                          • WakeAllConditionVariable, xrefs: 00AA0162
                                                          • SleepConditionVariableCS, xrefs: 00AA0154
                                                          • api-ms-win-core-synch-l1-2-0.dll, xrefs: 00AA0122
                                                          • kernel32.dll, xrefs: 00AA0133
                                                          • InitializeConditionVariable, xrefs: 00AA0148
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
                                                          • String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
                                                          • API String ID: 66158676-1714406822
                                                          • Opcode ID: 6884776bada938eb51a3e19e87eb8e0559789972622ec0947303c8f16696194c
                                                          • Instruction ID: 79abcac19d06b2f2bd67a667436abab71b1a80dc5d3b22565183389b89791149
                                                          • Opcode Fuzzy Hash: 6884776bada938eb51a3e19e87eb8e0559789972622ec0947303c8f16696194c
                                                          • Instruction Fuzzy Hash: 4C21A7326847116FDB116B64BD46FF937E4EB46F51F404679F805E72E1DF649C008A90
                                                          Function 00AE30F7 Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 400COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: _wcslen
                                                          • String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
                                                          • API String ID: 176396367-1603158881
                                                          • Opcode ID: 61275be9a411a77fd9613d5249f347637e12c4f570e7d71930248f212677f045
                                                          • Instruction ID: 9794f90fa1bfc526857457daad236012ad3f2e5269384052b9b78c111a3146de
                                                          • Opcode Fuzzy Hash: 61275be9a411a77fd9613d5249f347637e12c4f570e7d71930248f212677f045
                                                          • Instruction Fuzzy Hash: 54E10533A00556AFCF249F69C859BEEFBB0BF54710F548169E456E7280DB30AF8587A0
                                                          Function 00AF44C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CharLowerBuffW.USER32(00000000,00000000,00B1CC08), ref: 00AF4527
                                                          • _wcslen.LIBCMT ref: 00AF453B
                                                          • _wcslen.LIBCMT ref: 00AF4599
                                                          • _wcslen.LIBCMT ref: 00AF45F4
                                                          • _wcslen.LIBCMT ref: 00AF463F
                                                          • _wcslen.LIBCMT ref: 00AF46A7
                                                            • Part of subcall function 00A9F9F2: _wcslen.LIBCMT ref: 00A9F9FD
                                                          • GetDriveTypeW.KERNEL32(?,00B46BF0,00000061), ref: 00AF4743
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: _wcslen$BuffCharDriveLowerType
                                                          • String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
                                                          • API String ID: 2055661098-1000479233
                                                          • Opcode ID: 8ad8f9f54649984c3a2c5bb941911e29afa4b885b835880e59663612ce0a70df
                                                          • Instruction ID: e85c7a5e8ea5f341bb405b944d3311624819cbcfa615270e006d7eac04896af9
                                                          • Opcode Fuzzy Hash: 8ad8f9f54649984c3a2c5bb941911e29afa4b885b835880e59663612ce0a70df
                                                          • Instruction Fuzzy Hash: 3AB1FE316083069FC710EF68C990A7BB7E5AFAA760F50491DF696C7291E730DD44CBA2
                                                          Function 00B03FE9 Relevance: 23.2, APIs: 11, Strings: 2, Instructions: 478libraryloaderCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • LoadLibraryA.KERNEL32(kernel32.dll,?,00B1CC08), ref: 00B040BB
                                                          • GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00B040CD
                                                          • GetModuleFileNameW.KERNEL32(?,?,00000104,?,?,?,00B1CC08), ref: 00B040F2
                                                          • FreeLibrary.KERNEL32(00000000,?,00B1CC08), ref: 00B0413E
                                                          • StringFromGUID2.OLE32(?,?,00000028,?,00B1CC08), ref: 00B041A8
                                                          • SysFreeString.OLEAUT32(00000009), ref: 00B04262
                                                          • QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00B042C8
                                                          • SysFreeString.OLEAUT32(?), ref: 00B042F2
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: FreeString$Library$AddressFileFromLoadModuleNamePathProcQueryType
                                                          • String ID: GetModuleHandleExW$kernel32.dll
                                                          • API String ID: 354098117-199464113
                                                          • Opcode ID: 7a8d7e57bb5623e0e961b0b216ba36c5e6dac8c81ccff3b9de9a41804da7831f
                                                          • Instruction ID: fb81b6a5fcaf284728b403996695fa8a86214e13bd36bcdc3467b0bab8009544
                                                          • Opcode Fuzzy Hash: 7a8d7e57bb5623e0e961b0b216ba36c5e6dac8c81ccff3b9de9a41804da7831f
                                                          • Instruction Fuzzy Hash: C5122DB5A00115EFDB14DF54C984EAEBBF5FF45314F248098EA05AB2A1DB31ED46CBA0
                                                          Function 00A8326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetMenuItemCount.USER32(00B51990), ref: 00AC2F8D
                                                          • GetMenuItemCount.USER32(00B51990), ref: 00AC303D
                                                          • GetCursorPos.USER32(?), ref: 00AC3081
                                                          • SetForegroundWindow.USER32(00000000), ref: 00AC308A
                                                          • TrackPopupMenuEx.USER32(00B51990,00000000,?,00000000,00000000,00000000), ref: 00AC309D
                                                          • PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00AC30A9
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
                                                          • String ID: 0
                                                          • API String ID: 36266755-4108050209
                                                          • Opcode ID: ac935da290b6de1fed706a5ef7077354ea4b09d1a5494100668a30690bce8cd0
                                                          • Instruction ID: 141ab43e7b33296edc4bf19085d2cfeadc82b5a4b7ffdae74730998697256630
                                                          • Opcode Fuzzy Hash: ac935da290b6de1fed706a5ef7077354ea4b09d1a5494100668a30690bce8cd0
                                                          • Instruction Fuzzy Hash: 3F71F771644209BEEF259F28CC49FEABF75FF15764F20421AF5146A1E0CBB1A920DB90
                                                          Function 00B16CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • DestroyWindow.USER32(00000000,?), ref: 00B16DEB
                                                            • Part of subcall function 00A86B57: _wcslen.LIBCMT ref: 00A86B6A
                                                          • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00B16E5F
                                                          • SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00B16E81
                                                          • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00B16E94
                                                          • DestroyWindow.USER32(?), ref: 00B16EB5
                                                          • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00A80000,00000000), ref: 00B16EE4
                                                          • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00B16EFD
                                                          • GetDesktopWindow.USER32 ref: 00B16F16
                                                          • GetWindowRect.USER32(00000000), ref: 00B16F1D
                                                          • SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00B16F35
                                                          • SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00B16F4D
                                                            • Part of subcall function 00A99944: GetWindowLongW.USER32(?,000000EB), ref: 00A99952
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
                                                          • String ID: 0$tooltips_class32
                                                          • API String ID: 2429346358-3619404913
                                                          • Opcode ID: bff4677d6128856f33ceadcbb249768a8d25dc0b9397a33c7d501c057eaaebbb
                                                          • Instruction ID: 15053bc37e102afaae2ffa40bd2ce864a492e125f5c70df000bfdff56dd02c52
                                                          • Opcode Fuzzy Hash: bff4677d6128856f33ceadcbb249768a8d25dc0b9397a33c7d501c057eaaebbb
                                                          • Instruction Fuzzy Hash: 5B716675244340AFDB21CF18DC48BAABBE9FB89304F84499DF99987261CB70A946CB11
                                                          Function 00B1911E Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 181windowfileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00A99BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00A99BB2
                                                          • DragQueryPoint.SHELL32(?,?), ref: 00B19147
                                                            • Part of subcall function 00B17674: ClientToScreen.USER32(?,?), ref: 00B1769A
                                                            • Part of subcall function 00B17674: GetWindowRect.USER32(?,?), ref: 00B17710
                                                            • Part of subcall function 00B17674: PtInRect.USER32(?,?,00B18B89), ref: 00B17720
                                                          • SendMessageW.USER32(?,000000B0,?,?), ref: 00B191B0
                                                          • DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00B191BB
                                                          • DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00B191DE
                                                          • SendMessageW.USER32(?,000000C2,00000001,?), ref: 00B19225
                                                          • SendMessageW.USER32(?,000000B0,?,?), ref: 00B1923E
                                                          • SendMessageW.USER32(?,000000B1,?,?), ref: 00B19255
                                                          • SendMessageW.USER32(?,000000B1,?,?), ref: 00B19277
                                                          • DragFinish.SHELL32(?), ref: 00B1927E
                                                          • DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00B19371
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
                                                          • String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
                                                          • API String ID: 221274066-3440237614
                                                          • Opcode ID: b4e52cc1c8e08cdb63b7bb87072aa73438e9f2df8da808fc15e02ca4e880e331
                                                          • Instruction ID: 282fa3b120a7d97c5ad1f7affd4a96ef959be645a79398ba93f88f72a59f9c46
                                                          • Opcode Fuzzy Hash: b4e52cc1c8e08cdb63b7bb87072aa73438e9f2df8da808fc15e02ca4e880e331
                                                          • Instruction Fuzzy Hash: 59618B71108301AFD701EF64DD85EAFBBE8EF88750F40496EF595931A0DB309A49CB92
                                                          Function 00AFC476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00AFC4B0
                                                          • GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00AFC4C3
                                                          • SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00AFC4D7
                                                          • HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00AFC4F0
                                                          • InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 00AFC533
                                                          • InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00AFC549
                                                          • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00AFC554
                                                          • HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00AFC584
                                                          • GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00AFC5DC
                                                          • SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00AFC5F0
                                                          • InternetCloseHandle.WININET(00000000), ref: 00AFC5FB
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
                                                          • String ID:
                                                          • API String ID: 3800310941-3916222277
                                                          • Opcode ID: a0407e5ea6e6f641900205757226428c3e1f7864f9f8bf4f88b97e7959b91733
                                                          • Instruction ID: 32d8e2ccb387509c6ea1c6f12623558ce3e441e1341021c3a9b53b25391a98bc
                                                          • Opcode Fuzzy Hash: a0407e5ea6e6f641900205757226428c3e1f7864f9f8bf4f88b97e7959b91733
                                                          • Instruction Fuzzy Hash: 5C513CB158020DBFDB218FA1CA48ABB7BBCFB08764F008419FA46D7250DB74E944DB60
                                                          Function 00B1856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 00B18592
                                                          • GetFileSize.KERNEL32(00000000,00000000), ref: 00B185A2
                                                          • GlobalAlloc.KERNEL32(00000002,00000000), ref: 00B185AD
                                                          • CloseHandle.KERNEL32(00000000), ref: 00B185BA
                                                          • GlobalLock.KERNEL32(00000000), ref: 00B185C8
                                                          • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00B185D7
                                                          • GlobalUnlock.KERNEL32(00000000), ref: 00B185E0
                                                          • CloseHandle.KERNEL32(00000000), ref: 00B185E7
                                                          • CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 00B185F8
                                                          • OleLoadPicture.OLEAUT32(?,00000000,00000000,00B1FC38,?), ref: 00B18611
                                                          • GlobalFree.KERNEL32(00000000), ref: 00B18621
                                                          • GetObjectW.GDI32(?,00000018,000000FF), ref: 00B18641
                                                          • CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 00B18671
                                                          • DeleteObject.GDI32(00000000), ref: 00B18699
                                                          • SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00B186AF
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
                                                          • String ID:
                                                          • API String ID: 3840717409-0
                                                          • Opcode ID: 7c2353177f3917d8b73fd33b5dee5abba946b4936fee608287be541991d9d964
                                                          • Instruction ID: e8e8b301c7cf7dfe1f11ea4fc56579c18c52a40627c5a79cea4f842f99ab6e7b
                                                          • Opcode Fuzzy Hash: 7c2353177f3917d8b73fd33b5dee5abba946b4936fee608287be541991d9d964
                                                          • Instruction Fuzzy Hash: 55411875640208BFDB119FA5DC88EEA7BBDFF89B11F508068F905E7260DB309A41CB60
                                                          Function 00AF14BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • VariantInit.OLEAUT32(00000000), ref: 00AF1502
                                                          • VariantCopy.OLEAUT32(?,?), ref: 00AF150B
                                                          • VariantClear.OLEAUT32(?), ref: 00AF1517
                                                          • VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 00AF15FB
                                                          • VarR8FromDec.OLEAUT32(?,?), ref: 00AF1657
                                                          • VariantInit.OLEAUT32(?), ref: 00AF1708
                                                          • SysFreeString.OLEAUT32(?), ref: 00AF178C
                                                          • VariantClear.OLEAUT32(?), ref: 00AF17D8
                                                          • VariantClear.OLEAUT32(?), ref: 00AF17E7
                                                          • VariantInit.OLEAUT32(00000000), ref: 00AF1823
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
                                                          • String ID: %4d%02d%02d%02d%02d%02d$Default
                                                          • API String ID: 1234038744-3931177956
                                                          • Opcode ID: 2289a317dd05e3b5218c6ca2496fb912d2554d1162f29cbf0a26e51125d2ff5c
                                                          • Instruction ID: 3d52d88536be9c308f109e6d7ad932be72ebf7691cd2a864c8f877043a5805d5
                                                          • Opcode Fuzzy Hash: 2289a317dd05e3b5218c6ca2496fb912d2554d1162f29cbf0a26e51125d2ff5c
                                                          • Instruction Fuzzy Hash: 8DD1E071A04219EFDF04AFA5D985BB9B7F6BF44700F148056FA06AB280DB30EC41DBA1
                                                          Function 00B0B60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00A89CB3: _wcslen.LIBCMT ref: 00A89CBD
                                                            • Part of subcall function 00B0C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00B0B6AE,?,?), ref: 00B0C9B5
                                                            • Part of subcall function 00B0C998: _wcslen.LIBCMT ref: 00B0C9F1
                                                            • Part of subcall function 00B0C998: _wcslen.LIBCMT ref: 00B0CA68
                                                            • Part of subcall function 00B0C998: _wcslen.LIBCMT ref: 00B0CA9E
                                                          • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00B0B6F4
                                                          • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00B0B772
                                                          • RegDeleteValueW.ADVAPI32(?,?), ref: 00B0B80A
                                                          • RegCloseKey.ADVAPI32(?), ref: 00B0B87E
                                                          • RegCloseKey.ADVAPI32(?), ref: 00B0B89C
                                                          • LoadLibraryA.KERNEL32(advapi32.dll), ref: 00B0B8F2
                                                          • GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00B0B904
                                                          • RegDeleteKeyW.ADVAPI32(?,?), ref: 00B0B922
                                                          • FreeLibrary.KERNEL32(00000000), ref: 00B0B983
                                                          • RegCloseKey.ADVAPI32(00000000), ref: 00B0B994
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
                                                          • String ID: RegDeleteKeyExW$advapi32.dll
                                                          • API String ID: 146587525-4033151799
                                                          • Opcode ID: a01bba633c413f8fa09bf4ffebf3e457e89959b5b95f3eb74e65b1312e5a7dbb
                                                          • Instruction ID: eb970285cfd0070d7bc615b0f1b4babc2c9b4a4f92c3101b2656d8dd2cae8f7f
                                                          • Opcode Fuzzy Hash: a01bba633c413f8fa09bf4ffebf3e457e89959b5b95f3eb74e65b1312e5a7dbb
                                                          • Instruction Fuzzy Hash: DBC16B35208201AFD714DF24C495F2ABBE5FF84318F54859CF5AA8B2A2CB71ED45CB92
                                                          Function 00B0255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetDC.USER32(00000000), ref: 00B025D8
                                                          • CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00B025E8
                                                          • CreateCompatibleDC.GDI32(?), ref: 00B025F4
                                                          • SelectObject.GDI32(00000000,?), ref: 00B02601
                                                          • StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 00B0266D
                                                          • GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 00B026AC
                                                          • GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 00B026D0
                                                          • SelectObject.GDI32(?,?), ref: 00B026D8
                                                          • DeleteObject.GDI32(?), ref: 00B026E1
                                                          • DeleteDC.GDI32(?), ref: 00B026E8
                                                          • ReleaseDC.USER32(00000000,?), ref: 00B026F3
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
                                                          • String ID: (
                                                          • API String ID: 2598888154-3887548279
                                                          • Opcode ID: 579fd81ca27604b49fbb7bf5bed3ce7feb493886d94a048ee49f40baaabc0f38
                                                          • Instruction ID: 0fbfd9a91acc403864170d9ab1136931f79c3800fae381c80a3a6a91c98ce381
                                                          • Opcode Fuzzy Hash: 579fd81ca27604b49fbb7bf5bed3ce7feb493886d94a048ee49f40baaabc0f38
                                                          • Instruction Fuzzy Hash: DC61E275D00219EFCF04CFA4D888AAEBBF6FF48310F208569E955A7250D771A951CF50
                                                          Function 00ABDA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          • ___free_lconv_mon.LIBCMT ref: 00ABDAA1
                                                            • Part of subcall function 00ABD63C: _free.LIBCMT ref: 00ABD659
                                                            • Part of subcall function 00ABD63C: _free.LIBCMT ref: 00ABD66B
                                                            • Part of subcall function 00ABD63C: _free.LIBCMT ref: 00ABD67D
                                                            • Part of subcall function 00ABD63C: _free.LIBCMT ref: 00ABD68F
                                                            • Part of subcall function 00ABD63C: _free.LIBCMT ref: 00ABD6A1
                                                            • Part of subcall function 00ABD63C: _free.LIBCMT ref: 00ABD6B3
                                                            • Part of subcall function 00ABD63C: _free.LIBCMT ref: 00ABD6C5
                                                            • Part of subcall function 00ABD63C: _free.LIBCMT ref: 00ABD6D7
                                                            • Part of subcall function 00ABD63C: _free.LIBCMT ref: 00ABD6E9
                                                            • Part of subcall function 00ABD63C: _free.LIBCMT ref: 00ABD6FB
                                                            • Part of subcall function 00ABD63C: _free.LIBCMT ref: 00ABD70D
                                                            • Part of subcall function 00ABD63C: _free.LIBCMT ref: 00ABD71F
                                                            • Part of subcall function 00ABD63C: _free.LIBCMT ref: 00ABD731
                                                          • _free.LIBCMT ref: 00ABDA96
                                                            • Part of subcall function 00AB29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00ABD7D1,00000000,00000000,00000000,00000000,?,00ABD7F8,00000000,00000007,00000000,?,00ABDBF5,00000000), ref: 00AB29DE
                                                            • Part of subcall function 00AB29C8: GetLastError.KERNEL32(00000000,?,00ABD7D1,00000000,00000000,00000000,00000000,?,00ABD7F8,00000000,00000007,00000000,?,00ABDBF5,00000000,00000000), ref: 00AB29F0
                                                          • _free.LIBCMT ref: 00ABDAB8
                                                          • _free.LIBCMT ref: 00ABDACD
                                                          • _free.LIBCMT ref: 00ABDAD8
                                                          • _free.LIBCMT ref: 00ABDAFA
                                                          • _free.LIBCMT ref: 00ABDB0D
                                                          • _free.LIBCMT ref: 00ABDB1B
                                                          • _free.LIBCMT ref: 00ABDB26
                                                          • _free.LIBCMT ref: 00ABDB5E
                                                          • _free.LIBCMT ref: 00ABDB65
                                                          • _free.LIBCMT ref: 00ABDB82
                                                          • _free.LIBCMT ref: 00ABDB9A
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                                                          • String ID:
                                                          • API String ID: 161543041-0
                                                          • Opcode ID: 921339c503ddfbf06274601934e45e211732a45472e6d7c2e25a0c1875aeec6c
                                                          • Instruction ID: a27b927b7bf38ecaf30e75b4e6ccfa324c2f3442af1d7ecd18af0515840fe100
                                                          • Opcode Fuzzy Hash: 921339c503ddfbf06274601934e45e211732a45472e6d7c2e25a0c1875aeec6c
                                                          • Instruction Fuzzy Hash: B2313D31604705AFEB21AB39E945BD6BBEDFF40350F15481AE449D7193EF31AC508724
                                                          Function 00AE365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetClassNameW.USER32(?,?,00000100), ref: 00AE369C
                                                          • _wcslen.LIBCMT ref: 00AE36A7
                                                          • SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00AE3797
                                                          • GetClassNameW.USER32(?,?,00000400), ref: 00AE380C
                                                          • GetDlgCtrlID.USER32(?), ref: 00AE385D
                                                          • GetWindowRect.USER32(?,?), ref: 00AE3882
                                                          • GetParent.USER32(?), ref: 00AE38A0
                                                          • ScreenToClient.USER32(00000000), ref: 00AE38A7
                                                          • GetClassNameW.USER32(?,?,00000100), ref: 00AE3921
                                                          • GetWindowTextW.USER32(?,?,00000400), ref: 00AE395D
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
                                                          • String ID: %s%u
                                                          • API String ID: 4010501982-679674701
                                                          • Opcode ID: 057434578bd9d82e7b8a133ea4e325e6ca5d83dfe7d09136a24d728e64a78c14
                                                          • Instruction ID: 63e2b7191d9d8533b311f9673281e67d00b9e9b58812e686b138734a99f3eaaa
                                                          • Opcode Fuzzy Hash: 057434578bd9d82e7b8a133ea4e325e6ca5d83dfe7d09136a24d728e64a78c14
                                                          • Instruction Fuzzy Hash: 5E91C272204746AFDB18DF26C899BEAF7A8FF44350F408529F999C3191DB30EA45CB91
                                                          Function 00AE4954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetClassNameW.USER32(?,?,00000400), ref: 00AE4994
                                                          • GetWindowTextW.USER32(?,?,00000400), ref: 00AE49DA
                                                          • _wcslen.LIBCMT ref: 00AE49EB
                                                          • CharUpperBuffW.USER32(?,00000000), ref: 00AE49F7
                                                          • _wcsstr.LIBVCRUNTIME ref: 00AE4A2C
                                                          • GetClassNameW.USER32(00000018,?,00000400), ref: 00AE4A64
                                                          • GetWindowTextW.USER32(?,?,00000400), ref: 00AE4A9D
                                                          • GetClassNameW.USER32(00000018,?,00000400), ref: 00AE4AE6
                                                          • GetClassNameW.USER32(?,?,00000400), ref: 00AE4B20
                                                          • GetWindowRect.USER32(?,?), ref: 00AE4B8B
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
                                                          • String ID: ThumbnailClass
                                                          • API String ID: 1311036022-1241985126
                                                          • Opcode ID: f8b039579f48b3bb5dbd5ad9de2bbc58c390a474aab42322bb5bec2a70f33956
                                                          • Instruction ID: 836d595a7298707f0787da297bd7394e536067b999f1faa824377cd77c6df523
                                                          • Opcode Fuzzy Hash: f8b039579f48b3bb5dbd5ad9de2bbc58c390a474aab42322bb5bec2a70f33956
                                                          • Instruction Fuzzy Hash: 7D9189710083459BDB04DF16C985BAABBECEF88354F048469FD859B096EB34ED45CBA1
                                                          Function 00AEBF30 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 190windowsleepCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetMenuItemInfoW.USER32(00B51990,000000FF,00000000,00000030), ref: 00AEBFAC
                                                          • SetMenuItemInfoW.USER32(00B51990,00000004,00000000,00000030), ref: 00AEBFE1
                                                          • Sleep.KERNEL32(000001F4), ref: 00AEBFF3
                                                          • GetMenuItemCount.USER32(?), ref: 00AEC039
                                                          • GetMenuItemID.USER32(?,00000000), ref: 00AEC056
                                                          • GetMenuItemID.USER32(?,-00000001), ref: 00AEC082
                                                          • GetMenuItemID.USER32(?,?), ref: 00AEC0C9
                                                          • CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00AEC10F
                                                          • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00AEC124
                                                          • SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00AEC145
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: ItemMenu$Info$CheckCountRadioSleep
                                                          • String ID: 0
                                                          • API String ID: 1460738036-4108050209
                                                          • Opcode ID: af2969a33b6778d1fbea258bd99da276681987fe3375fef9269661ef913b4893
                                                          • Instruction ID: 8964c2a327ef33e035c18ef26cf4b23a2fd4bf1ed58985e5a3c162babb2ca9d2
                                                          • Opcode Fuzzy Hash: af2969a33b6778d1fbea258bd99da276681987fe3375fef9269661ef913b4893
                                                          • Instruction Fuzzy Hash: 81617EB090038AAFDF11DF69DD88AEEBBB9FB05364F144155E811A3291CB35AD16CB60
                                                          Function 00B0CC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00B0CC64
                                                          • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 00B0CC8D
                                                          • FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00B0CD48
                                                            • Part of subcall function 00B0CC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 00B0CCAA
                                                            • Part of subcall function 00B0CC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 00B0CCBD
                                                            • Part of subcall function 00B0CC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00B0CCCF
                                                            • Part of subcall function 00B0CC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00B0CD05
                                                            • Part of subcall function 00B0CC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00B0CD28
                                                          • RegDeleteKeyW.ADVAPI32(?,?), ref: 00B0CCF3
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
                                                          • String ID: RegDeleteKeyExW$advapi32.dll
                                                          • API String ID: 2734957052-4033151799
                                                          • Opcode ID: 104dc5312c8d306c7e3e098ac1548dc6eda5c95152802d61b22059e0ccc00317
                                                          • Instruction ID: a7e8c179af5b439886ac730822fc4b99ca753cf31743a045cad9469501a751b7
                                                          • Opcode Fuzzy Hash: 104dc5312c8d306c7e3e098ac1548dc6eda5c95152802d61b22059e0ccc00317
                                                          • Instruction Fuzzy Hash: D3316F71941129BBDB208B55DC88EFFBFBCEF45750F0042A5B906E3290DB349E45DAA0
                                                          Function 00AF3D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00AF3D40
                                                          • _wcslen.LIBCMT ref: 00AF3D6D
                                                          • CreateDirectoryW.KERNEL32(?,00000000), ref: 00AF3D9D
                                                          • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00AF3DBE
                                                          • RemoveDirectoryW.KERNEL32(?), ref: 00AF3DCE
                                                          • DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00AF3E55
                                                          • CloseHandle.KERNEL32(00000000), ref: 00AF3E60
                                                          • CloseHandle.KERNEL32(00000000), ref: 00AF3E6B
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
                                                          • String ID: :$\$\??\%s
                                                          • API String ID: 1149970189-3457252023
                                                          • Opcode ID: 4e77cd73d9adda5151e09837c3021deadcef54c16a8a2ed00c6aa8c31606b16a
                                                          • Instruction ID: b31eb17e465dd42d4c7673d36a3f677f90a6f4b6bd3cf10679bf8f016a6d6d31
                                                          • Opcode Fuzzy Hash: 4e77cd73d9adda5151e09837c3021deadcef54c16a8a2ed00c6aa8c31606b16a
                                                          • Instruction Fuzzy Hash: FF31AF72A40219ABDF209FA0DC49FEF3BBDEF89740F5040A5F619D60A0EB7097448B64
                                                          Function 00AEE6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • timeGetTime.WINMM ref: 00AEE6B4
                                                            • Part of subcall function 00A9E551: timeGetTime.WINMM(?,?,00AEE6D4), ref: 00A9E555
                                                          • Sleep.KERNEL32(0000000A), ref: 00AEE6E1
                                                          • EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 00AEE705
                                                          • FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00AEE727
                                                          • SetActiveWindow.USER32 ref: 00AEE746
                                                          • SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00AEE754
                                                          • SendMessageW.USER32(00000010,00000000,00000000), ref: 00AEE773
                                                          • Sleep.KERNEL32(000000FA), ref: 00AEE77E
                                                          • IsWindow.USER32 ref: 00AEE78A
                                                          • EndDialog.USER32(00000000), ref: 00AEE79B
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
                                                          • String ID: BUTTON
                                                          • API String ID: 1194449130-3405671355
                                                          • Opcode ID: a8c2da6f69e5c4a3beb534702e38b18a351c038a3ced3b04c6075bfbce06b17b
                                                          • Instruction ID: ae5340bb6df2585cb144b28cf8cc2d8a4c4c8dc76ec559b30660d53d09822db9
                                                          • Opcode Fuzzy Hash: a8c2da6f69e5c4a3beb534702e38b18a351c038a3ced3b04c6075bfbce06b17b
                                                          • Instruction Fuzzy Hash: EE21A2B0280385BFEB009F22EC89B663F6AF75634AF504865F505831B1DF71AC108B25
                                                          Function 00AEE9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00A89CB3: _wcslen.LIBCMT ref: 00A89CBD
                                                          • mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00AEEA5D
                                                          • mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00AEEA73
                                                          • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00AEEA84
                                                          • mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00AEEA96
                                                          • mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00AEEAA7
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: SendString$_wcslen
                                                          • String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
                                                          • API String ID: 2420728520-1007645807
                                                          • Opcode ID: 44335ba0be477467f3710686075d7c42d00257e5b97dcff0a4b3deb97ddeddee
                                                          • Instruction ID: 3de6210b5fb33fc1265e32b630ad58da9c072252730ceb795986b46b8f332a99
                                                          • Opcode Fuzzy Hash: 44335ba0be477467f3710686075d7c42d00257e5b97dcff0a4b3deb97ddeddee
                                                          • Instruction Fuzzy Hash: E1115131A9026979D720F7A2DD4ADFF6BBCEBD6B40F400469B401A20E1EEB00A05D6B1
                                                          Function 00AE9F91 Relevance: 18.2, APIs: 12, Instructions: 188keyboardCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetKeyboardState.USER32(?), ref: 00AEA012
                                                          • SetKeyboardState.USER32(?), ref: 00AEA07D
                                                          • GetAsyncKeyState.USER32(000000A0), ref: 00AEA09D
                                                          • GetKeyState.USER32(000000A0), ref: 00AEA0B4
                                                          • GetAsyncKeyState.USER32(000000A1), ref: 00AEA0E3
                                                          • GetKeyState.USER32(000000A1), ref: 00AEA0F4
                                                          • GetAsyncKeyState.USER32(00000011), ref: 00AEA120
                                                          • GetKeyState.USER32(00000011), ref: 00AEA12E
                                                          • GetAsyncKeyState.USER32(00000012), ref: 00AEA157
                                                          • GetKeyState.USER32(00000012), ref: 00AEA165
                                                          • GetAsyncKeyState.USER32(0000005B), ref: 00AEA18E
                                                          • GetKeyState.USER32(0000005B), ref: 00AEA19C
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: State$Async$Keyboard
                                                          • String ID:
                                                          • API String ID: 541375521-0
                                                          • Opcode ID: c2f07bed68065f22c28ad7a80d19eaae8ef4ac142486f6db4fa7d149eca17cf3
                                                          • Instruction ID: 36b76ebbc7507b0692e40402b3345dbc0ef93cc17ed1c51697c62cbbfb36e3a8
                                                          • Opcode Fuzzy Hash: c2f07bed68065f22c28ad7a80d19eaae8ef4ac142486f6db4fa7d149eca17cf3
                                                          • Instruction Fuzzy Hash: 6351BA30A047C829FB35EB6289157EBBFB59F22380F088599D5C2571C2DA54BA4CC766
                                                          Function 00AE5CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetDlgItem.USER32(?,00000001), ref: 00AE5CE2
                                                          • GetWindowRect.USER32(00000000,?), ref: 00AE5CFB
                                                          • MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 00AE5D59
                                                          • GetDlgItem.USER32(?,00000002), ref: 00AE5D69
                                                          • GetWindowRect.USER32(00000000,?), ref: 00AE5D7B
                                                          • MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 00AE5DCF
                                                          • GetDlgItem.USER32(?,000003E9), ref: 00AE5DDD
                                                          • GetWindowRect.USER32(00000000,?), ref: 00AE5DEF
                                                          • MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 00AE5E31
                                                          • GetDlgItem.USER32(?,000003EA), ref: 00AE5E44
                                                          • MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00AE5E5A
                                                          • InvalidateRect.USER32(?,00000000,00000001), ref: 00AE5E67
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Window$ItemMoveRect$Invalidate
                                                          • String ID:
                                                          • API String ID: 3096461208-0
                                                          • Opcode ID: 47d5e379aea0d8ab258e806fb954a6188a8d6659fc40954be13ad667f80f4970
                                                          • Instruction ID: b9787a5aa7cbd3f319b3f9461d5f8fc919d04765253f8ced120d8b164c7547d0
                                                          • Opcode Fuzzy Hash: 47d5e379aea0d8ab258e806fb954a6188a8d6659fc40954be13ad667f80f4970
                                                          • Instruction Fuzzy Hash: CB510BB1E40609AFDF18CF69DD89AAEBBB5EB48314F548129F915E7290DB709E00CB50
                                                          Function 00A98BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00A98F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00A98BE8,?,00000000,?,?,?,?,00A98BBA,00000000,?), ref: 00A98FC5
                                                          • DestroyWindow.USER32(?), ref: 00A98C81
                                                          • KillTimer.USER32(00000000,?,?,?,?,00A98BBA,00000000,?), ref: 00A98D1B
                                                          • DestroyAcceleratorTable.USER32(00000000), ref: 00AD6973
                                                          • ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,00A98BBA,00000000,?), ref: 00AD69A1
                                                          • ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,00A98BBA,00000000,?), ref: 00AD69B8
                                                          • ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00A98BBA,00000000), ref: 00AD69D4
                                                          • DeleteObject.GDI32(00000000), ref: 00AD69E6
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
                                                          • String ID:
                                                          • API String ID: 641708696-0
                                                          • Opcode ID: f5d99702383586dc0b2d38cf412655252e0d1eface4a0d8f24f4f8e370c0e7f1
                                                          • Instruction ID: 6c60d689c445ade85e7134414f39a42944cb0a1b1f540366b48f7682c044a54b
                                                          • Opcode Fuzzy Hash: f5d99702383586dc0b2d38cf412655252e0d1eface4a0d8f24f4f8e370c0e7f1
                                                          • Instruction Fuzzy Hash: 8D619A30602700DFDF219F18CA58B697BF1FB46312F548959E0829B6A0CB79AD81CF90
                                                          Function 00A99838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00A99944: GetWindowLongW.USER32(?,000000EB), ref: 00A99952
                                                          • GetSysColor.USER32(0000000F), ref: 00A99862
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: ColorLongWindow
                                                          • String ID:
                                                          • API String ID: 259745315-0
                                                          • Opcode ID: 101e05584f6b205a4c3ad175a04856a0d889b6aeaeb54599c760456482cc6164
                                                          • Instruction ID: 539ddf47f6e2c974e04df7e6327e66dbfc7c64883ce9805506ca2e5259be129c
                                                          • Opcode Fuzzy Hash: 101e05584f6b205a4c3ad175a04856a0d889b6aeaeb54599c760456482cc6164
                                                          • Instruction Fuzzy Hash: 3841A131244640BFDF205F3C9C88BBA3BA5AB06331F54861DF9A2972E1EB319C42DB11
                                                          Function 00AE96E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,00ACF7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 00AE9717
                                                          • LoadStringW.USER32(00000000,?,00ACF7F8,00000001), ref: 00AE9720
                                                            • Part of subcall function 00A89CB3: _wcslen.LIBCMT ref: 00A89CBD
                                                          • GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,00ACF7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 00AE9742
                                                          • LoadStringW.USER32(00000000,?,00ACF7F8,00000001), ref: 00AE9745
                                                          • MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 00AE9866
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: HandleLoadModuleString$Message_wcslen
                                                          • String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
                                                          • API String ID: 747408836-2268648507
                                                          • Opcode ID: 902412c40225de4f6ee1dedda4c6050ebe8e316be5edf67290bdc9f967518346
                                                          • Instruction ID: c7b6dea2fd2338b1b61f43260b7bd6d4015ab5e09d1a22b80faa0b87c131cb28
                                                          • Opcode Fuzzy Hash: 902412c40225de4f6ee1dedda4c6050ebe8e316be5edf67290bdc9f967518346
                                                          • Instruction Fuzzy Hash: 8B413972900209AADF04FBE1CE86EEFB778EF15740F540065F605760A2EB256F49CBA1
                                                          Function 00AE06DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00A86B57: _wcslen.LIBCMT ref: 00A86B6A
                                                          • WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00AE07A2
                                                          • RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00AE07BE
                                                          • RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00AE07DA
                                                          • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00AE0804
                                                          • CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 00AE082C
                                                          • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00AE0837
                                                          • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00AE083C
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
                                                          • String ID: SOFTWARE\Classes\$\CLSID$\IPC$
                                                          • API String ID: 323675364-22481851
                                                          • Opcode ID: c37257b2ad16f5fce27d5824d843287fbd3a9e003b08f160003282fcda22bb69
                                                          • Instruction ID: 3eb0a83ea9400bda350efba4d293edcc320c589497ce2b3a82468510c888287b
                                                          • Opcode Fuzzy Hash: c37257b2ad16f5fce27d5824d843287fbd3a9e003b08f160003282fcda22bb69
                                                          • Instruction Fuzzy Hash: D8413672C10229ABDF21EFA4DC85DEEB7B8FF14340F444129E901A71A1EB709E44CBA0
                                                          Function 00B13F98 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00B1403B
                                                          • CreateCompatibleDC.GDI32(00000000), ref: 00B14042
                                                          • SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00B14055
                                                          • SelectObject.GDI32(00000000,00000000), ref: 00B1405D
                                                          • GetPixel.GDI32(00000000,00000000,00000000), ref: 00B14068
                                                          • DeleteDC.GDI32(00000000), ref: 00B14072
                                                          • GetWindowLongW.USER32(?,000000EC), ref: 00B1407C
                                                          • SetLayeredWindowAttributes.USER32(?,?,00000000,00000001,?,00000000,?), ref: 00B14092
                                                          • DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?), ref: 00B1409E
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
                                                          • String ID: static
                                                          • API String ID: 2559357485-2160076837
                                                          • Opcode ID: 7992d29e18439bc08681610df50d7fd32c46211edf13494552cb53d3c285f175
                                                          • Instruction ID: d833afd53b70fa8674016b2fe2162acc53c83ab21a6eb48fae0a17409fdfb599
                                                          • Opcode Fuzzy Hash: 7992d29e18439bc08681610df50d7fd32c46211edf13494552cb53d3c285f175
                                                          • Instruction Fuzzy Hash: 41317A32540219BBDF219FA4CC09FDA3FA9FF0D720F514250FA18A60A0CB75D860DB50
                                                          Function 00B03C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • VariantInit.OLEAUT32(?), ref: 00B03C5C
                                                          • CoInitialize.OLE32(00000000), ref: 00B03C8A
                                                          • CoUninitialize.OLE32 ref: 00B03C94
                                                          • _wcslen.LIBCMT ref: 00B03D2D
                                                          • GetRunningObjectTable.OLE32(00000000,?), ref: 00B03DB1
                                                          • SetErrorMode.KERNEL32(00000001,00000029), ref: 00B03ED5
                                                          • CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 00B03F0E
                                                          • CoGetObject.OLE32(?,00000000,00B1FB98,?), ref: 00B03F2D
                                                          • SetErrorMode.KERNEL32(00000000), ref: 00B03F40
                                                          • SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00B03FC4
                                                          • VariantClear.OLEAUT32(?), ref: 00B03FD8
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
                                                          • String ID:
                                                          • API String ID: 429561992-0
                                                          • Opcode ID: 0e8e7a36c8a90c11b85345ea7fe026d581accc1de5e3e71c1f1e8b7b2d461b58
                                                          • Instruction ID: 6a4f36ba264e1f9c9be5fad0d5758878501e333d280804aac711621c67f7a423
                                                          • Opcode Fuzzy Hash: 0e8e7a36c8a90c11b85345ea7fe026d581accc1de5e3e71c1f1e8b7b2d461b58
                                                          • Instruction Fuzzy Hash: B2C158716083019FD700DF68C98896BBBE9FF89B44F14499DF98A9B290DB31ED05CB52
                                                          Function 00AF7A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CoInitialize.OLE32(00000000), ref: 00AF7AF3
                                                          • SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00AF7B8F
                                                          • SHGetDesktopFolder.SHELL32(?), ref: 00AF7BA3
                                                          • CoCreateInstance.OLE32(00B1FD08,00000000,00000001,00B46E6C,?), ref: 00AF7BEF
                                                          • SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00AF7C74
                                                          • CoTaskMemFree.OLE32(?,?), ref: 00AF7CCC
                                                          • SHBrowseForFolderW.SHELL32(?), ref: 00AF7D57
                                                          • SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00AF7D7A
                                                          • CoTaskMemFree.OLE32(00000000), ref: 00AF7D81
                                                          • CoTaskMemFree.OLE32(00000000), ref: 00AF7DD6
                                                          • CoUninitialize.OLE32 ref: 00AF7DDC
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
                                                          • String ID:
                                                          • API String ID: 2762341140-0
                                                          • Opcode ID: a4d32f28cb8a0f61375d5859ab1c92edbffe96cf5a89c97cdc8185e07368ac07
                                                          • Instruction ID: 2d1002ffbb8d72a92cb3f8b6c57bfb1cfafa060b6261ff331a64f90359242507
                                                          • Opcode Fuzzy Hash: a4d32f28cb8a0f61375d5859ab1c92edbffe96cf5a89c97cdc8185e07368ac07
                                                          • Instruction Fuzzy Hash: 13C11975A04109AFCB14DFA4C884DAEBBF9FF49304B148499F91A9B361DB30EE45CB90
                                                          Function 00B1541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00B15504
                                                          • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00B15515
                                                          • CharNextW.USER32(00000158), ref: 00B15544
                                                          • SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00B15585
                                                          • SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00B1559B
                                                          • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00B155AC
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$CharNext
                                                          • String ID:
                                                          • API String ID: 1350042424-0
                                                          • Opcode ID: 6f712d179ee1abbb77e4474f2ee6a2326de9cebd4f196f2f0f3ec02da869527b
                                                          • Instruction ID: da4fb2cf9f83562637600dad741cbe5de6e2624434fb342e5726de11f71b1358
                                                          • Opcode Fuzzy Hash: 6f712d179ee1abbb77e4474f2ee6a2326de9cebd4f196f2f0f3ec02da869527b
                                                          • Instruction Fuzzy Hash: F8619170900608EFDF209F54CC85AFE7BF9EB89761F908185F525AB294D7709AC0DB61
                                                          Function 00ADFA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00ADFAAF
                                                          • SafeArrayAllocData.OLEAUT32(?), ref: 00ADFB08
                                                          • VariantInit.OLEAUT32(?), ref: 00ADFB1A
                                                          • SafeArrayAccessData.OLEAUT32(?,?), ref: 00ADFB3A
                                                          • VariantCopy.OLEAUT32(?,?), ref: 00ADFB8D
                                                          • SafeArrayUnaccessData.OLEAUT32(?), ref: 00ADFBA1
                                                          • VariantClear.OLEAUT32(?), ref: 00ADFBB6
                                                          • SafeArrayDestroyData.OLEAUT32(?), ref: 00ADFBC3
                                                          • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00ADFBCC
                                                          • VariantClear.OLEAUT32(?), ref: 00ADFBDE
                                                          • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00ADFBE9
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
                                                          • String ID:
                                                          • API String ID: 2706829360-0
                                                          • Opcode ID: 8aa1c35b41f1135fb6433f372d5fbca1d2acb6b1b32033bdbe6e60eff54fd41b
                                                          • Instruction ID: 8d95a49ff1063c929d5641cdb6cdfee287d59a64fa78c88bf2d4d549f308acd6
                                                          • Opcode Fuzzy Hash: 8aa1c35b41f1135fb6433f372d5fbca1d2acb6b1b32033bdbe6e60eff54fd41b
                                                          • Instruction Fuzzy Hash: A3414135A042199FDB00DFA8D8549EEBFB9EF48354F50806AE947A7361DB30A945CFA0
                                                          Function 00AE9C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetKeyboardState.USER32(?), ref: 00AE9CA1
                                                          • GetAsyncKeyState.USER32(000000A0), ref: 00AE9D22
                                                          • GetKeyState.USER32(000000A0), ref: 00AE9D3D
                                                          • GetAsyncKeyState.USER32(000000A1), ref: 00AE9D57
                                                          • GetKeyState.USER32(000000A1), ref: 00AE9D6C
                                                          • GetAsyncKeyState.USER32(00000011), ref: 00AE9D84
                                                          • GetKeyState.USER32(00000011), ref: 00AE9D96
                                                          • GetAsyncKeyState.USER32(00000012), ref: 00AE9DAE
                                                          • GetKeyState.USER32(00000012), ref: 00AE9DC0
                                                          • GetAsyncKeyState.USER32(0000005B), ref: 00AE9DD8
                                                          • GetKeyState.USER32(0000005B), ref: 00AE9DEA
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: State$Async$Keyboard
                                                          • String ID:
                                                          • API String ID: 541375521-0
                                                          • Opcode ID: 5e742045dd96577b84df19f1196685d5c7a05340071868b9ef249b99f8440573
                                                          • Instruction ID: 9987e9ac32632df8c290c9ab8fcac1c0f25c81a407ab97b18b03bbf02c41affc
                                                          • Opcode Fuzzy Hash: 5e742045dd96577b84df19f1196685d5c7a05340071868b9ef249b99f8440573
                                                          • Instruction Fuzzy Hash: FB41F7345047DA6DFF30976288443F7BEE16F21344F48805ADAC6575C2EBA4A9C8C7A2
                                                          Function 00B0055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • WSAStartup.WSOCK32(00000101,?), ref: 00B005BC
                                                          • inet_addr.WSOCK32(?), ref: 00B0061C
                                                          • gethostbyname.WSOCK32(?), ref: 00B00628
                                                          • IcmpCreateFile.IPHLPAPI ref: 00B00636
                                                          • IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00B006C6
                                                          • IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00B006E5
                                                          • IcmpCloseHandle.IPHLPAPI(?), ref: 00B007B9
                                                          • WSACleanup.WSOCK32 ref: 00B007BF
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
                                                          • String ID: Ping
                                                          • API String ID: 1028309954-2246546115
                                                          • Opcode ID: b4ee58295a0ebe47b1d9d45d36edebec8869662b78a0d637c4b516082e8562f9
                                                          • Instruction ID: 2a299c2353ae6b5b01f84c9f5b8eef6348d41af5dbb1fee34eafe5e847eb4c1f
                                                          • Opcode Fuzzy Hash: b4ee58295a0ebe47b1d9d45d36edebec8869662b78a0d637c4b516082e8562f9
                                                          • Instruction Fuzzy Hash: DB91A0356182019FD720EF15C988F1ABFE0EF45318F1485A9F46A9B6A2CB34ED45CF91
                                                          Function 00B08CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: _wcslen$BuffCharLower
                                                          • String ID: cdecl$none$stdcall$winapi
                                                          • API String ID: 707087890-567219261
                                                          • Opcode ID: bf6b9ee75be8aa36bed365100ec6fa7cbfa9bbd63af8f9f39ddcdd7ffb73c4dd
                                                          • Instruction ID: ee20b571c686cdb141eca6c226e26c7d3dbf46cb454085f4f37c3da10f453971
                                                          • Opcode Fuzzy Hash: bf6b9ee75be8aa36bed365100ec6fa7cbfa9bbd63af8f9f39ddcdd7ffb73c4dd
                                                          • Instruction Fuzzy Hash: FF519131A005169BCF14DF68C9808BEBBE6FF65720B2542A9E4A6E72C4DF30DE40C790
                                                          Function 00B0372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CoInitialize.OLE32 ref: 00B03774
                                                          • CoUninitialize.OLE32 ref: 00B0377F
                                                          • CoCreateInstance.OLE32(?,00000000,00000017,00B1FB78,?), ref: 00B037D9
                                                          • IIDFromString.OLE32(?,?), ref: 00B0384C
                                                          • VariantInit.OLEAUT32(?), ref: 00B038E4
                                                          • VariantClear.OLEAUT32(?), ref: 00B03936
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
                                                          • String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
                                                          • API String ID: 636576611-1287834457
                                                          • Opcode ID: 17b67178a7c4cacbbd825bfca415490ae1baedd4b2865dc00bd6480dc062ed3c
                                                          • Instruction ID: 16f6cb9824d35892059359dffaf7be1fe66f59d7066c2357df68145bc61ead4f
                                                          • Opcode Fuzzy Hash: 17b67178a7c4cacbbd825bfca415490ae1baedd4b2865dc00bd6480dc062ed3c
                                                          • Instruction Fuzzy Hash: 9A61A370608301AFD711DF54C989F6ABBE8FF49B14F104989F5859B291D770EE48CB92
                                                          Function 00AF3388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • LoadStringW.USER32(00000066,?,00000FFF,?), ref: 00AF33CF
                                                            • Part of subcall function 00A89CB3: _wcslen.LIBCMT ref: 00A89CBD
                                                          • LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00AF33F0
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: LoadString$_wcslen
                                                          • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
                                                          • API String ID: 4099089115-3080491070
                                                          • Opcode ID: 2fbfbd7c9bbccf3fe2a09d264571932432549a7327d87583e63422e0c9664fca
                                                          • Instruction ID: 27c2ce8c49ae04d51a130435cea58fc9a74b5ccf3d86866e7b54d2f47fc53918
                                                          • Opcode Fuzzy Hash: 2fbfbd7c9bbccf3fe2a09d264571932432549a7327d87583e63422e0c9664fca
                                                          • Instruction Fuzzy Hash: 35517B72900209BADF14EBE0CE56EFEB7B8EF14740F1444A5F505720A2EB252F58DB61
                                                          Function 00AEB5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: _wcslen$BuffCharUpper
                                                          • String ID: APPEND$EXISTS$KEYS$REMOVE
                                                          • API String ID: 1256254125-769500911
                                                          • Opcode ID: d81b111fa894a2695e89ca815844d6c346a233d5a460f79eda2d929567599e28
                                                          • Instruction ID: a90fc1e335291cb91617f49d451905cbdd16effe949481fd3373ec8da7075f0a
                                                          • Opcode Fuzzy Hash: d81b111fa894a2695e89ca815844d6c346a233d5a460f79eda2d929567599e28
                                                          • Instruction Fuzzy Hash: 45411832A100679BCB206F7ECD945BFB7B5AFA1754B244529E421DB284F731CD81C7A0
                                                          Function 00AF5393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SetErrorMode.KERNEL32(00000001), ref: 00AF53A0
                                                          • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00AF5416
                                                          • GetLastError.KERNEL32 ref: 00AF5420
                                                          • SetErrorMode.KERNEL32(00000000,READY), ref: 00AF54A7
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Error$Mode$DiskFreeLastSpace
                                                          • String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
                                                          • API String ID: 4194297153-14809454
                                                          • Opcode ID: b8261a329d86d1a1fbfbeb7a3beea92b6d6258dc5d712901a6819da7e1490afa
                                                          • Instruction ID: ae4787d808a1d06cfa7c8952798de3f12869e3b763ebb2d51b64e76e767133e7
                                                          • Opcode Fuzzy Hash: b8261a329d86d1a1fbfbeb7a3beea92b6d6258dc5d712901a6819da7e1490afa
                                                          • Instruction Fuzzy Hash: 71319F75E006099FD710DFA8C584ABABBB5EF05306F148069F605DB292DB31DE82CBA1
                                                          Function 00B13C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CreateMenu.USER32 ref: 00B13C79
                                                          • SetMenu.USER32(?,00000000), ref: 00B13C88
                                                          • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00B13D10
                                                          • IsMenu.USER32(?), ref: 00B13D24
                                                          • CreatePopupMenu.USER32 ref: 00B13D2E
                                                          • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00B13D5B
                                                          • DrawMenuBar.USER32 ref: 00B13D63
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Menu$CreateItem$DrawInfoInsertPopup
                                                          • String ID: 0$F
                                                          • API String ID: 161812096-3044882817
                                                          • Opcode ID: 2257f957548198ef77dc086a2e0e4ed7fe4486f5bf1bf247019bc1dfb46f490c
                                                          • Instruction ID: 43c85edb0cf309fa80f3b2f06c1e6fcd30ede949e45ebd8ea01b73fcf1ae2b72
                                                          • Opcode Fuzzy Hash: 2257f957548198ef77dc086a2e0e4ed7fe4486f5bf1bf247019bc1dfb46f490c
                                                          • Instruction Fuzzy Hash: 15418A74A01209EFDB14CF64E885BEA7BF6FF49304F544068E91697360EB30AA10CB90
                                                          Function 00AE1EDF Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00A89CB3: _wcslen.LIBCMT ref: 00A89CBD
                                                            • Part of subcall function 00AE3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00AE3CCA
                                                          • SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 00AE1F64
                                                          • GetDlgCtrlID.USER32 ref: 00AE1F6F
                                                          • GetParent.USER32 ref: 00AE1F8B
                                                          • SendMessageW.USER32(00000000,?,00000111,?), ref: 00AE1F8E
                                                          • GetDlgCtrlID.USER32(?), ref: 00AE1F97
                                                          • GetParent.USER32(?), ref: 00AE1FAB
                                                          • SendMessageW.USER32(00000000,?,00000111,?), ref: 00AE1FAE
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$CtrlParent$ClassName_wcslen
                                                          • String ID: ComboBox$ListBox
                                                          • API String ID: 711023334-1403004172
                                                          • Opcode ID: 869a3598a4d9ce246c2b7afae85305d7bef2d5f68d05a2c0e47abc348100ded7
                                                          • Instruction ID: 2680076f29887799beb794f608d82be819ed3d655fff18587d135c222fadddcd
                                                          • Opcode Fuzzy Hash: 869a3598a4d9ce246c2b7afae85305d7bef2d5f68d05a2c0e47abc348100ded7
                                                          • Instruction Fuzzy Hash: D321D171940214BFCF04AFA1CC85DFEBBB8EF05310F104156F961A72A1DB359918DBA0
                                                          Function 00AE1FC0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 77windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00A89CB3: _wcslen.LIBCMT ref: 00A89CBD
                                                            • Part of subcall function 00AE3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00AE3CCA
                                                          • SendMessageW.USER32(?,00000186,00020000,00000000), ref: 00AE2043
                                                          • GetDlgCtrlID.USER32 ref: 00AE204E
                                                          • GetParent.USER32 ref: 00AE206A
                                                          • SendMessageW.USER32(00000000,?,00000111,?), ref: 00AE206D
                                                          • GetDlgCtrlID.USER32(?), ref: 00AE2076
                                                          • GetParent.USER32(?), ref: 00AE208A
                                                          • SendMessageW.USER32(00000000,?,00000111,?), ref: 00AE208D
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$CtrlParent$ClassName_wcslen
                                                          • String ID: ComboBox$ListBox
                                                          • API String ID: 711023334-1403004172
                                                          • Opcode ID: edbda34ff1eb531d8bfaa7414cf0fc9f4400fec5f5687ce6c8e63c812bc4c369
                                                          • Instruction ID: 8f448849d15e069677618622a396f8f0813c16945f7ce7b376eca1d17046d5cd
                                                          • Opcode Fuzzy Hash: edbda34ff1eb531d8bfaa7414cf0fc9f4400fec5f5687ce6c8e63c812bc4c369
                                                          • Instruction Fuzzy Hash: D921F3B1940218BFCF11AFA1CC85EFEBFB8EF09300F104045F951A71A1DA758918DB60
                                                          Function 00B13A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00B13A9D
                                                          • SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00B13AA0
                                                          • GetWindowLongW.USER32(?,000000F0), ref: 00B13AC7
                                                          • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00B13AEA
                                                          • SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00B13B62
                                                          • SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00B13BAC
                                                          • SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00B13BC7
                                                          • SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00B13BE2
                                                          • SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00B13BF6
                                                          • SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00B13C13
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$LongWindow
                                                          • String ID:
                                                          • API String ID: 312131281-0
                                                          • Opcode ID: 511b5a2263af9db45be409f2c885d119b076a8419d2bd7c2955e5c9b4d48c123
                                                          • Instruction ID: bd7e74062b76cdc4631d6d3226109617229da247a9d91b2760b126f3cb2e3884
                                                          • Opcode Fuzzy Hash: 511b5a2263af9db45be409f2c885d119b076a8419d2bd7c2955e5c9b4d48c123
                                                          • Instruction Fuzzy Hash: F3615B75900248AFDB10DFA8CC81FEE77F8EB09714F104199FA15A72A1D774AE85DB50
                                                          Function 00AEB12F Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetCurrentThreadId.KERNEL32 ref: 00AEB151
                                                          • GetForegroundWindow.USER32(00000000,?,?,?,?,?,00AEA1E1,?,00000001), ref: 00AEB165
                                                          • GetWindowThreadProcessId.USER32(00000000), ref: 00AEB16C
                                                          • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00AEA1E1,?,00000001), ref: 00AEB17B
                                                          • GetWindowThreadProcessId.USER32(?,00000000), ref: 00AEB18D
                                                          • AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,00AEA1E1,?,00000001), ref: 00AEB1A6
                                                          • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00AEA1E1,?,00000001), ref: 00AEB1B8
                                                          • AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00AEA1E1,?,00000001), ref: 00AEB1FD
                                                          • AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,00AEA1E1,?,00000001), ref: 00AEB212
                                                          • AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,00AEA1E1,?,00000001), ref: 00AEB21D
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Thread$AttachInput$Window$Process$CurrentForeground
                                                          • String ID:
                                                          • API String ID: 2156557900-0
                                                          • Opcode ID: 3bb40374342963d48e786b3cc43b9a87dadfe54ea147bf1fff8a3ce3eab12db3
                                                          • Instruction ID: 87f2008ab10391ec8a6df669d8b0f644966dbc8399be626fb4a394ee4e968b6c
                                                          • Opcode Fuzzy Hash: 3bb40374342963d48e786b3cc43b9a87dadfe54ea147bf1fff8a3ce3eab12db3
                                                          • Instruction Fuzzy Hash: A331BB75560344BFDB129F25DC58BAF7BA9BF517A2F648008FA00D72A0DBB49A408F74
                                                          Function 00AB2C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • _free.LIBCMT ref: 00AB2C94
                                                            • Part of subcall function 00AB29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00ABD7D1,00000000,00000000,00000000,00000000,?,00ABD7F8,00000000,00000007,00000000,?,00ABDBF5,00000000), ref: 00AB29DE
                                                            • Part of subcall function 00AB29C8: GetLastError.KERNEL32(00000000,?,00ABD7D1,00000000,00000000,00000000,00000000,?,00ABD7F8,00000000,00000007,00000000,?,00ABDBF5,00000000,00000000), ref: 00AB29F0
                                                          • _free.LIBCMT ref: 00AB2CA0
                                                          • _free.LIBCMT ref: 00AB2CAB
                                                          • _free.LIBCMT ref: 00AB2CB6
                                                          • _free.LIBCMT ref: 00AB2CC1
                                                          • _free.LIBCMT ref: 00AB2CCC
                                                          • _free.LIBCMT ref: 00AB2CD7
                                                          • _free.LIBCMT ref: 00AB2CE2
                                                          • _free.LIBCMT ref: 00AB2CED
                                                          • _free.LIBCMT ref: 00AB2CFB
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: _free$ErrorFreeHeapLast
                                                          • String ID:
                                                          • API String ID: 776569668-0
                                                          • Opcode ID: 50c223c0a47512d6f9cae30164502de825c919affc2e5dcb679888b71b846d1c
                                                          • Instruction ID: b81bf8882f4cef83c85d38486ea20b9c05f3509535c971f7694da3c79e112ea6
                                                          • Opcode Fuzzy Hash: 50c223c0a47512d6f9cae30164502de825c919affc2e5dcb679888b71b846d1c
                                                          • Instruction Fuzzy Hash: 5F114676510108BFCB02EF54DA42EDD3BA9FF45350F5149A6F9485B222DA31EE509B90
                                                          Function 00AF7DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00AF7FAD
                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 00AF7FC1
                                                          • GetFileAttributesW.KERNEL32(?), ref: 00AF7FEB
                                                          • SetFileAttributesW.KERNEL32(?,00000000), ref: 00AF8005
                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 00AF8017
                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 00AF8060
                                                          • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00AF80B0
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: CurrentDirectory$AttributesFile
                                                          • String ID: *.*
                                                          • API String ID: 769691225-438819550
                                                          • Opcode ID: 40f605e9f8f7c712e84caa7bcfd3ac2b86eeb4b7d01e8f1156fa11f3f871c8d9
                                                          • Instruction ID: 285d4c5ac6ff0f111153e589cebee56ef2d021db9216dafebb9d64201b558946
                                                          • Opcode Fuzzy Hash: 40f605e9f8f7c712e84caa7bcfd3ac2b86eeb4b7d01e8f1156fa11f3f871c8d9
                                                          • Instruction Fuzzy Hash: B381CE725082099BCB20EF94C844ABEB3E8BF89314F54485FFA85C7250EB34DD49CB92
                                                          Function 00A85BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SetWindowLongW.USER32(?,000000EB), ref: 00A85C7A
                                                            • Part of subcall function 00A85D0A: GetClientRect.USER32(?,?), ref: 00A85D30
                                                            • Part of subcall function 00A85D0A: GetWindowRect.USER32(?,?), ref: 00A85D71
                                                            • Part of subcall function 00A85D0A: ScreenToClient.USER32(?,?), ref: 00A85D99
                                                          • GetDC.USER32 ref: 00AC46F5
                                                          • SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00AC4708
                                                          • SelectObject.GDI32(00000000,00000000), ref: 00AC4716
                                                          • SelectObject.GDI32(00000000,00000000), ref: 00AC472B
                                                          • ReleaseDC.USER32(?,00000000), ref: 00AC4733
                                                          • MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00AC47C4
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
                                                          • String ID: U
                                                          • API String ID: 4009187628-3372436214
                                                          • Opcode ID: 7890387852bffeeadd7d036b0d8a5ef72f19ac7c63af7b25a7925bf70e7eea7b
                                                          • Instruction ID: 13f08f46055dc75eed670ad275f763c1a09d3136d6ad81cf6c0b6d8bdcdb4f53
                                                          • Opcode Fuzzy Hash: 7890387852bffeeadd7d036b0d8a5ef72f19ac7c63af7b25a7925bf70e7eea7b
                                                          • Instruction Fuzzy Hash: C971DC31800205DFCF219F64C994FEA3BB6FF4A324F154269ED565A2AAC7308C81DF60
                                                          Function 00AF359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 00AF35E4
                                                            • Part of subcall function 00A89CB3: _wcslen.LIBCMT ref: 00A89CBD
                                                          • LoadStringW.USER32(00B52390,?,00000FFF,?), ref: 00AF360A
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: LoadString$_wcslen
                                                          • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
                                                          • API String ID: 4099089115-2391861430
                                                          • Opcode ID: acc6c48e15b0991f5d0e2614210d702044dafb0720462982bbd3143f8b2793b6
                                                          • Instruction ID: 84998b5e2b64ab291253d393d1bac4436199644691224083246456a3e6341f3b
                                                          • Opcode Fuzzy Hash: acc6c48e15b0991f5d0e2614210d702044dafb0720462982bbd3143f8b2793b6
                                                          • Instruction Fuzzy Hash: B951387280020ABADF14FBE0CE46AFEBB78AF14300F144165F205761A1EB311B99DBA1
                                                          Function 00AFC253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00AFC272
                                                          • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00AFC29A
                                                          • HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00AFC2CA
                                                          • GetLastError.KERNEL32 ref: 00AFC322
                                                          • SetEvent.KERNEL32(?), ref: 00AFC336
                                                          • InternetCloseHandle.WININET(00000000), ref: 00AFC341
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
                                                          • String ID:
                                                          • API String ID: 3113390036-3916222277
                                                          • Opcode ID: 817b8518391de8d6a81c01b252dd06a9636dd0eecf247cb6c50f8da75494aecf
                                                          • Instruction ID: c2984343db4b57b7bd34ad1e1904b6bcd2d1f6370b55649710f32be0caf9e040
                                                          • Opcode Fuzzy Hash: 817b8518391de8d6a81c01b252dd06a9636dd0eecf247cb6c50f8da75494aecf
                                                          • Instruction Fuzzy Hash: 7F31937150020CAFD7219FA68E88ABBBBFCEB49794B54851DF546D7240DB30DD049B61
                                                          Function 00AE989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00AC3AAF,?,?,Bad directive syntax error,00B1CC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 00AE98BC
                                                          • LoadStringW.USER32(00000000,?,00AC3AAF,?), ref: 00AE98C3
                                                            • Part of subcall function 00A89CB3: _wcslen.LIBCMT ref: 00A89CBD
                                                          • MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00AE9987
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: HandleLoadMessageModuleString_wcslen
                                                          • String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
                                                          • API String ID: 858772685-4153970271
                                                          • Opcode ID: 754de4a4dd8abfe1333d11cc85e447843b4edc78aa61020dc29dc7f96eb94bb4
                                                          • Instruction ID: cf4f4caf865f645f178607cad1308c1e5c5ba48297445d9e3c25b394652a0afa
                                                          • Opcode Fuzzy Hash: 754de4a4dd8abfe1333d11cc85e447843b4edc78aa61020dc29dc7f96eb94bb4
                                                          • Instruction Fuzzy Hash: 21218B3294021AAFCF15AF90CD0AEFE7779FF19700F044469F515660A2EB719A28EB51
                                                          Function 00AE209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetParent.USER32 ref: 00AE20AB
                                                          • GetClassNameW.USER32(00000000,?,00000100), ref: 00AE20C0
                                                          • SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00AE214D
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: ClassMessageNameParentSend
                                                          • String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
                                                          • API String ID: 1290815626-3381328864
                                                          • Opcode ID: e67ceb04e60e382137b78e1bc46428a8eaccfdc828a2a9e5334a1d75a5e2f12e
                                                          • Instruction ID: 76d1f888f6869c703dc9fbd2690cc86011fe220cde5411045954be26e72063ef
                                                          • Opcode Fuzzy Hash: e67ceb04e60e382137b78e1bc46428a8eaccfdc828a2a9e5334a1d75a5e2f12e
                                                          • Instruction Fuzzy Hash: C2112C766C4706BAF6116721DC07EE637DCCB05364B200256F704A60F2FFB15A016714
                                                          Function 00AB8D45 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 9c424790cac348a14454be649df833163f6625fa79526c29771ca227f02e36df
                                                          • Instruction ID: 90b35a5ce29e0745b5f6dc5bf96f849258c754789f70bf6f0acfe4fce8e70d69
                                                          • Opcode Fuzzy Hash: 9c424790cac348a14454be649df833163f6625fa79526c29771ca227f02e36df
                                                          • Instruction Fuzzy Hash: A8C1D174A04349AFDF11EFACD841BEEBBB8AF1A310F144199E915A7393CB349941CB61
                                                          Function 00ABCE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: _free$EnvironmentVariable___from_strstr_to_strchr
                                                          • String ID:
                                                          • API String ID: 1282221369-0
                                                          • Opcode ID: 3ae3fd786cd6cf7ba34043d25e798cc79f80eb836d4538e5dd32bb1960bc00da
                                                          • Instruction ID: 8c195e4fad89231056323bafd89f5aaacf40ce8ebdb3e697cd28dd00d3648680
                                                          • Opcode Fuzzy Hash: 3ae3fd786cd6cf7ba34043d25e798cc79f80eb836d4538e5dd32bb1960bc00da
                                                          • Instruction Fuzzy Hash: FD610571A04301AFDB25BFB89981FFA7BADEF05320F0445AEF94597283EA319D019790
                                                          Function 00B150D4 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SendMessageW.USER32(?,00002001,00000000,00000000), ref: 00B15186
                                                          • ShowWindow.USER32(?,00000000), ref: 00B151C7
                                                          • ShowWindow.USER32(?,00000005,?,00000000), ref: 00B151CD
                                                          • SetFocus.USER32(?,?,00000005,?,00000000), ref: 00B151D1
                                                            • Part of subcall function 00B16FBA: DeleteObject.GDI32(00000000), ref: 00B16FE6
                                                          • GetWindowLongW.USER32(?,000000F0), ref: 00B1520D
                                                          • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00B1521A
                                                          • InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00B1524D
                                                          • SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 00B15287
                                                          • SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 00B15296
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
                                                          • String ID:
                                                          • API String ID: 3210457359-0
                                                          • Opcode ID: 5e4cdc0bfacffb8856b69b6ed50ac4eb7edfd87bc02472576d4e4265747785e1
                                                          • Instruction ID: 8728193f9f9ba54eaa7f485167b4150f3b8dac4d296c9425819cdaef599fa8d3
                                                          • Opcode Fuzzy Hash: 5e4cdc0bfacffb8856b69b6ed50ac4eb7edfd87bc02472576d4e4265747785e1
                                                          • Instruction Fuzzy Hash: 2251B431A90A08FEEF319F24CC45BD93BE5EB86321F948195F515A72E0C7B599D0DB80
                                                          Function 00A98B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 00AD6890
                                                          • ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 00AD68A9
                                                          • LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00AD68B9
                                                          • ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 00AD68D1
                                                          • SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00AD68F2
                                                          • DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00A98874,00000000,00000000,00000000,000000FF,00000000), ref: 00AD6901
                                                          • SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00AD691E
                                                          • DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00A98874,00000000,00000000,00000000,000000FF,00000000), ref: 00AD692D
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Icon$DestroyExtractImageLoadMessageSend
                                                          • String ID:
                                                          • API String ID: 1268354404-0
                                                          • Opcode ID: 817be64d3d35708523f4b2567fc6c69cafd0b6eccdc767da8523757f17115ae0
                                                          • Instruction ID: 8b24ee6fecc4e9434bbe67f7e7a7ad94c9ae6b4f09a76907502cc34aaf6e1c32
                                                          • Opcode Fuzzy Hash: 817be64d3d35708523f4b2567fc6c69cafd0b6eccdc767da8523757f17115ae0
                                                          • Instruction Fuzzy Hash: A0517470600209AFDF20CF28CC95BAE7BF6EB58760F144519F906972A0DB74E990DB50
                                                          Function 00AFC143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00AFC182
                                                          • GetLastError.KERNEL32 ref: 00AFC195
                                                          • SetEvent.KERNEL32(?), ref: 00AFC1A9
                                                            • Part of subcall function 00AFC253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00AFC272
                                                            • Part of subcall function 00AFC253: GetLastError.KERNEL32 ref: 00AFC322
                                                            • Part of subcall function 00AFC253: SetEvent.KERNEL32(?), ref: 00AFC336
                                                            • Part of subcall function 00AFC253: InternetCloseHandle.WININET(00000000), ref: 00AFC341
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
                                                          • String ID:
                                                          • API String ID: 337547030-0
                                                          • Opcode ID: b49c422d4fa8061d4339af2a7e13a22f0c841eca0c225d697623c1bc5313d636
                                                          • Instruction ID: d5032df0d4e663be10b6b1a22542a5a292e5ad89ae8b14db57c24a8f2395088b
                                                          • Opcode Fuzzy Hash: b49c422d4fa8061d4339af2a7e13a22f0c841eca0c225d697623c1bc5313d636
                                                          • Instruction Fuzzy Hash: F9318D7114060DAFDB21AFE6DE44AF6BBF8FF18320B00851DFA5683611DB30E9149BA0
                                                          Function 00AE25A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00AE3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00AE3A57
                                                            • Part of subcall function 00AE3A3D: GetCurrentThreadId.KERNEL32 ref: 00AE3A5E
                                                            • Part of subcall function 00AE3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00AE25B3), ref: 00AE3A65
                                                          • MapVirtualKeyW.USER32(00000025,00000000), ref: 00AE25BD
                                                          • PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00AE25DB
                                                          • Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 00AE25DF
                                                          • MapVirtualKeyW.USER32(00000025,00000000), ref: 00AE25E9
                                                          • PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00AE2601
                                                          • Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00AE2605
                                                          • MapVirtualKeyW.USER32(00000025,00000000), ref: 00AE260F
                                                          • PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00AE2623
                                                          • Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00AE2627
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
                                                          • String ID:
                                                          • API String ID: 2014098862-0
                                                          • Opcode ID: f85cefd9f3f26655ddf71319ed4e28de45a02c2b0cf5df08dc183b4cad3094f0
                                                          • Instruction ID: a165cd63ec9510f17e5e4d2cf27826669df9d6746bf2e8aba2f04be89137d2ad
                                                          • Opcode Fuzzy Hash: f85cefd9f3f26655ddf71319ed4e28de45a02c2b0cf5df08dc183b4cad3094f0
                                                          • Instruction Fuzzy Hash: D001D4313D0354BBFB1067699C8EF993F99DB4EB52F604011F318AF0D5CDE224448A69
                                                          Function 00AE1803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00AE1449,?,?,00000000), ref: 00AE180C
                                                          • HeapAlloc.KERNEL32(00000000,?,00AE1449,?,?,00000000), ref: 00AE1813
                                                          • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00AE1449,?,?,00000000), ref: 00AE1828
                                                          • GetCurrentProcess.KERNEL32(?,00000000,?,00AE1449,?,?,00000000), ref: 00AE1830
                                                          • DuplicateHandle.KERNEL32(00000000,?,00AE1449,?,?,00000000), ref: 00AE1833
                                                          • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00AE1449,?,?,00000000), ref: 00AE1843
                                                          • GetCurrentProcess.KERNEL32(00AE1449,00000000,?,00AE1449,?,?,00000000), ref: 00AE184B
                                                          • DuplicateHandle.KERNEL32(00000000,?,00AE1449,?,?,00000000), ref: 00AE184E
                                                          • CreateThread.KERNEL32(00000000,00000000,00AE1874,00000000,00000000,00000000), ref: 00AE1868
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
                                                          • String ID:
                                                          • API String ID: 1957940570-0
                                                          • Opcode ID: 6ea89ef34c2a53c2314a838de8d95348326a0c57da3546bf38bbf7956cafc706
                                                          • Instruction ID: 605e8968f4f7f7fadcfeb4a6a7389ca6b35c393ad60edc59d3c484314930b441
                                                          • Opcode Fuzzy Hash: 6ea89ef34c2a53c2314a838de8d95348326a0c57da3546bf38bbf7956cafc706
                                                          • Instruction Fuzzy Hash: D501BFB52C0344BFE710AB65DC4DF977FACEB89B11F508411FA05DB191CA709810CB20
                                                          Function 00B0A0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00AED4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 00AED501
                                                            • Part of subcall function 00AED4DC: Process32FirstW.KERNEL32(00000000,?), ref: 00AED50F
                                                            • Part of subcall function 00AED4DC: CloseHandle.KERNEL32(00000000), ref: 00AED5DC
                                                          • OpenProcess.KERNEL32(00000001,00000000,?), ref: 00B0A16D
                                                          • GetLastError.KERNEL32 ref: 00B0A180
                                                          • OpenProcess.KERNEL32(00000001,00000000,?), ref: 00B0A1B3
                                                          • TerminateProcess.KERNEL32(00000000,00000000), ref: 00B0A268
                                                          • GetLastError.KERNEL32(00000000), ref: 00B0A273
                                                          • CloseHandle.KERNEL32(00000000), ref: 00B0A2C4
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
                                                          • String ID: SeDebugPrivilege
                                                          • API String ID: 2533919879-2896544425
                                                          • Opcode ID: cbaf2eac452bcc4a39b905c2e307caa5075e92c8cc77a028f02cf956aecd113d
                                                          • Instruction ID: c6e9c73e9b9b8445aafd6d10074f7e9e783c2db2fcd412b4f3c1b846419e135e
                                                          • Opcode Fuzzy Hash: cbaf2eac452bcc4a39b905c2e307caa5075e92c8cc77a028f02cf956aecd113d
                                                          • Instruction Fuzzy Hash: 81616A30204342AFE720DF19C594F16BBE1AF54318F54889CE4668B6A3CB72ED49CB92
                                                          Function 00B13886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00B13925
                                                          • SendMessageW.USER32(00000000,00001036,00000000,?), ref: 00B1393A
                                                          • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00B13954
                                                          • _wcslen.LIBCMT ref: 00B13999
                                                          • SendMessageW.USER32(?,00001057,00000000,?), ref: 00B139C6
                                                          • SendMessageW.USER32(?,00001061,?,0000000F), ref: 00B139F4
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$Window_wcslen
                                                          • String ID: SysListView32
                                                          • API String ID: 2147712094-78025650
                                                          • Opcode ID: d1789386db441fcf889065c141258ef34a3aafc26127b3370eb0862ee0fa74c9
                                                          • Instruction ID: 0ca923eeb6146bb31e5fa3705616ec77a841181a60ff88a38c0d6fe665e046cf
                                                          • Opcode Fuzzy Hash: d1789386db441fcf889065c141258ef34a3aafc26127b3370eb0862ee0fa74c9
                                                          • Instruction Fuzzy Hash: 6941C431A00218ABEF219F64CC45FEA7BE9EF08750F500566F959E7281E7719E80CB90
                                                          Function 00AEBC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00AEBCFD
                                                          • IsMenu.USER32(00000000), ref: 00AEBD1D
                                                          • CreatePopupMenu.USER32 ref: 00AEBD53
                                                          • GetMenuItemCount.USER32(01696710), ref: 00AEBDA4
                                                          • InsertMenuItemW.USER32(01696710,?,00000001,00000030), ref: 00AEBDCC
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Menu$Item$CountCreateInfoInsertPopup
                                                          • String ID: 0$2
                                                          • API String ID: 93392585-3793063076
                                                          • Opcode ID: 38e84baeb3ff4f7e475dc65e6af821107e88c9151232d626889f6753f2fe8978
                                                          • Instruction ID: 0bbdb9e15fe1df37dfc9136a7a0886d2fcbb256ec644c70a7e0a61cca36f8f8a
                                                          • Opcode Fuzzy Hash: 38e84baeb3ff4f7e475dc65e6af821107e88c9151232d626889f6753f2fe8978
                                                          • Instruction Fuzzy Hash: CE519C70A102899BDF20CFAADDC8BAFBBF9AF55314F248229E411D7291D7709941CB71
                                                          Function 00AEC874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • LoadIconW.USER32(00000000,00007F03), ref: 00AEC913
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: IconLoad
                                                          • String ID: blank$info$question$stop$warning
                                                          • API String ID: 2457776203-404129466
                                                          • Opcode ID: f094d8ad83e019ac2dd21fe353c605cd1ed63c468d9c801c3ab1a9251c2c9fac
                                                          • Instruction ID: e9ea3da781bcf42dfab73aab87d442adde9d37f858d1ed34d91da4132a09d3ca
                                                          • Opcode Fuzzy Hash: f094d8ad83e019ac2dd21fe353c605cd1ed63c468d9c801c3ab1a9251c2c9fac
                                                          • Instruction Fuzzy Hash: F5112C32689346BAE7019B55DD83CEE77ECDF16374B60006AF900A72D3E7B45E016269
                                                          Function 00AEDE27 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
                                                          • String ID: 0.0.0.0
                                                          • API String ID: 642191829-3771769585
                                                          • Opcode ID: dddbe30444d2514a735d0b6fcad27718d63c5c62860ec423a80e0e7fd59f0121
                                                          • Instruction ID: c342bbfbc3919013d245e5d08d1b4309a1c8c9e38a5b16d4849cd6d84185a3d6
                                                          • Opcode Fuzzy Hash: dddbe30444d2514a735d0b6fcad27718d63c5c62860ec423a80e0e7fd59f0121
                                                          • Instruction Fuzzy Hash: 0811D371904215AFCB20AB61DD4AEEF7BBCDF56711F0001A9F545EB0D1EFB18E818AA0
                                                          Function 00B19F86 Relevance: 12.3, APIs: 8, Instructions: 260windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00A99BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00A99BB2
                                                          • GetSystemMetrics.USER32(0000000F), ref: 00B19FC7
                                                          • GetSystemMetrics.USER32(0000000F), ref: 00B19FE7
                                                          • MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 00B1A224
                                                          • SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00B1A242
                                                          • SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00B1A263
                                                          • ShowWindow.USER32(00000003,00000000), ref: 00B1A282
                                                          • InvalidateRect.USER32(?,00000000,00000001), ref: 00B1A2A7
                                                          • DefDlgProcW.USER32(?,00000005,?,?), ref: 00B1A2CA
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
                                                          • String ID:
                                                          • API String ID: 1211466189-0
                                                          • Opcode ID: 283a1de3c9da73ee6ae14ca0fffb4911aa75b8fa884640890be8bc6b67f0eac5
                                                          • Instruction ID: 557a9be006253e1ceb831bfa6da6a7099ac61fd0020efa2140779c4fbde84fa8
                                                          • Opcode Fuzzy Hash: 283a1de3c9da73ee6ae14ca0fffb4911aa75b8fa884640890be8bc6b67f0eac5
                                                          • Instruction Fuzzy Hash: 36B1B731601215EBCF14CF68C9857EE7BF2FF48701F5880A9EC49AB295DB31A980CB91
                                                          Function 00AEED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: _wcslen$LocalTime
                                                          • String ID:
                                                          • API String ID: 952045576-0
                                                          • Opcode ID: b5729f8759112dcf4c64d9f938e3adf026942de542abcde844c992d712b5b36b
                                                          • Instruction ID: a92afc3b3ddc2db6d58a36d4efdbc4d7af36c1a384196ebea148f2d7b586efa7
                                                          • Opcode Fuzzy Hash: b5729f8759112dcf4c64d9f938e3adf026942de542abcde844c992d712b5b36b
                                                          • Instruction Fuzzy Hash: C241B265C10258B6DB11EBF5CC8AACFB7ACAF46310F508462F518E3161FB34E255C7A5
                                                          Function 00A9F8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00AD682C,00000004,00000000,00000000), ref: 00A9F953
                                                          • ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,00AD682C,00000004,00000000,00000000), ref: 00ADF3D1
                                                          • ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00AD682C,00000004,00000000,00000000), ref: 00ADF454
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: ShowWindow
                                                          • String ID:
                                                          • API String ID: 1268545403-0
                                                          • Opcode ID: 31fea9b5cb9831b3a10c7b703678aa0b312a6129384cbcc38afa92b41ef5fada
                                                          • Instruction ID: 89beb3174bdbe663bad00a75c7a4601b4b1429d39857e2da9e993c3597ed6fa5
                                                          • Opcode Fuzzy Hash: 31fea9b5cb9831b3a10c7b703678aa0b312a6129384cbcc38afa92b41ef5fada
                                                          • Instruction Fuzzy Hash: D741F831718680BECF399B2DCD8876B7FE2AB56314F54843DE497D7660CA71A880CB11
                                                          Function 00B12D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • DeleteObject.GDI32(00000000), ref: 00B12D1B
                                                          • GetDC.USER32(00000000), ref: 00B12D23
                                                          • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00B12D2E
                                                          • ReleaseDC.USER32(00000000,00000000), ref: 00B12D3A
                                                          • CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00B12D76
                                                          • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00B12D87
                                                          • MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00B15A65,?,?,000000FF,00000000,?,000000FF,?), ref: 00B12DC2
                                                          • SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00B12DE1
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
                                                          • String ID:
                                                          • API String ID: 3864802216-0
                                                          • Opcode ID: 8b58bb1c28b99336d496936f5065bda119660b7bdde84234f4b81686f183adba
                                                          • Instruction ID: 4ea0c0e766f9ff87952661941d78c4f005ec3ebd9c9a632aa1ee4943a8821dc1
                                                          • Opcode Fuzzy Hash: 8b58bb1c28b99336d496936f5065bda119660b7bdde84234f4b81686f183adba
                                                          • Instruction Fuzzy Hash: F0316B72241214BFEB158F50DC8AFEB3FA9EB09715F4480A5FE089B291CA759C50CBA4
                                                          Function 00AE5622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: _memcmp
                                                          • String ID:
                                                          • API String ID: 2931989736-0
                                                          • Opcode ID: 2a82d3c0362c2cfee96e1c051ecbbb9b3cf9dcc925cdd04d78b967983ac98a36
                                                          • Instruction ID: c4249a8884e0308e8c64560a4b23ec1d0b8d76208525fd85b31c9377fd0275c9
                                                          • Opcode Fuzzy Hash: 2a82d3c0362c2cfee96e1c051ecbbb9b3cf9dcc925cdd04d78b967983ac98a36
                                                          • Instruction Fuzzy Hash: 7B219871E409457796149A326E92FFB33ACAE11388F580020FD045F5C1F761ED50C1F5
                                                          Function 00B04FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: NULL Pointer assignment$Not an Object type
                                                          • API String ID: 0-572801152
                                                          • Opcode ID: 1ef8327a3305c29b19722276bb3a27c0cbfc1c36b4a77d9bd8ff0c39ee8a01c7
                                                          • Instruction ID: 70cafdfd61bc3f623b0edaa95ca9333e16721f6d1ebc5b91e48326115c868b65
                                                          • Opcode Fuzzy Hash: 1ef8327a3305c29b19722276bb3a27c0cbfc1c36b4a77d9bd8ff0c39ee8a01c7
                                                          • Instruction Fuzzy Hash: BFD17D75A0060A9FDF20CF98C881AAEBBF5FF48344F1484A9E915AB691E770DD45CF90
                                                          Function 00AC1522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetCPInfo.KERNEL32(?,?), ref: 00AC15CE
                                                          • MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00AC1651
                                                          • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00AC16E4
                                                          • MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00AC16FB
                                                            • Part of subcall function 00AB3820: RtlAllocateHeap.NTDLL(00000000,?,00B51444,?,00A9FDF5,?,?,00A8A976,00000010,00B51440,00A813FC,?,00A813C6,?,00A81129), ref: 00AB3852
                                                          • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00AC1777
                                                          • __freea.LIBCMT ref: 00AC17A2
                                                          • __freea.LIBCMT ref: 00AC17AE
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
                                                          • String ID:
                                                          • API String ID: 2829977744-0
                                                          • Opcode ID: 1ae1371ac1f310c2194e0c5de66d62454a6f9198de54e8a769ee33d5e9bc7106
                                                          • Instruction ID: 6ffaa93b93273f3a45bb86edc5de0d70dc46750a9a48aa35e5d07896af5be96e
                                                          • Opcode Fuzzy Hash: 1ae1371ac1f310c2194e0c5de66d62454a6f9198de54e8a769ee33d5e9bc7106
                                                          • Instruction Fuzzy Hash: 23919272F0021A9ADF208F64C991FEE7BB5AF4A710F1A465DE801E7242DB35DD41CBA0
                                                          Function 00B04523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Variant$ClearInit
                                                          • String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
                                                          • API String ID: 2610073882-625585964
                                                          • Opcode ID: 21e4ecfd7dc24634b6f76d1e2b3be1d2fc30b4fc5389e2e4aafd1fd908884011
                                                          • Instruction ID: e924d1cfdfd3667b2cecfe3025e582b8c767575d4673d534f7b8e892b0b56f69
                                                          • Opcode Fuzzy Hash: 21e4ecfd7dc24634b6f76d1e2b3be1d2fc30b4fc5389e2e4aafd1fd908884011
                                                          • Instruction Fuzzy Hash: 4B9171B1A00215ABDF20CFA5D884FAE7BF8EF46714F108599F615AB281D7709D45CFA0
                                                          Function 00AF1187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 00AF125C
                                                          • SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00AF1284
                                                          • SafeArrayUnaccessData.OLEAUT32(00000001), ref: 00AF12A8
                                                          • SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00AF12D8
                                                          • SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00AF135F
                                                          • SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00AF13C4
                                                          • SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00AF1430
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: ArraySafe$Data$Access$UnaccessVartype
                                                          • String ID:
                                                          • API String ID: 2550207440-0
                                                          • Opcode ID: 034d2239e80d2831b745c60463b99156eba8eac40b1350fc0cadf87c68a84408
                                                          • Instruction ID: 2b8016729c61b2b6cd2ae7ae0f9c5a8b58c9c77f86a96d8ad3d7fc6309ad911b
                                                          • Opcode Fuzzy Hash: 034d2239e80d2831b745c60463b99156eba8eac40b1350fc0cadf87c68a84408
                                                          • Instruction Fuzzy Hash: 3A919B75A00219EFDB009FE8C884BBEB7B5FF45325F108029FA51EB291D774A941CB90
                                                          Function 00A9948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: ObjectSelect$BeginCreatePath
                                                          • String ID:
                                                          • API String ID: 3225163088-0
                                                          • Opcode ID: 75b6758c37a516b77df585e0b808d3b8d2aa1d1857e3bae9695e266779e4e0a8
                                                          • Instruction ID: 05adddf305d93eb692145fb58f4191380a02fe1da68225f99a2aa5e782af5267
                                                          • Opcode Fuzzy Hash: 75b6758c37a516b77df585e0b808d3b8d2aa1d1857e3bae9695e266779e4e0a8
                                                          • Instruction Fuzzy Hash: B7912571A40219AFCF15CFA9C888AEFBBB8FF49320F14805AE515B7251D774AA41CB60
                                                          Function 00B03947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • VariantInit.OLEAUT32(?), ref: 00B0396B
                                                          • CharUpperBuffW.USER32(?,?), ref: 00B03A7A
                                                          • _wcslen.LIBCMT ref: 00B03A8A
                                                          • VariantClear.OLEAUT32(?), ref: 00B03C1F
                                                            • Part of subcall function 00AF0CDF: VariantInit.OLEAUT32(00000000), ref: 00AF0D1F
                                                            • Part of subcall function 00AF0CDF: VariantCopy.OLEAUT32(?,?), ref: 00AF0D28
                                                            • Part of subcall function 00AF0CDF: VariantClear.OLEAUT32(?), ref: 00AF0D34
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
                                                          • String ID: AUTOIT.ERROR$Incorrect Parameter format
                                                          • API String ID: 4137639002-1221869570
                                                          • Opcode ID: a8d0330efa1b973a7899c1ca1e61321992df2f33dd9a5e26f150229c90eb1837
                                                          • Instruction ID: ffd7055cab0d4932fa257945345eba5d30f400fc0d4f122fbaf54107ae8a8fe8
                                                          • Opcode Fuzzy Hash: a8d0330efa1b973a7899c1ca1e61321992df2f33dd9a5e26f150229c90eb1837
                                                          • Instruction Fuzzy Hash: 6C916D756083059FC704EF24C58496ABBE8FF89714F14886DF48A97391DB30EE45CB92
                                                          Function 00B04BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00AE000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00ADFF41,80070057,?,?,?,00AE035E), ref: 00AE002B
                                                            • Part of subcall function 00AE000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00ADFF41,80070057,?,?), ref: 00AE0046
                                                            • Part of subcall function 00AE000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00ADFF41,80070057,?,?), ref: 00AE0054
                                                            • Part of subcall function 00AE000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00ADFF41,80070057,?), ref: 00AE0064
                                                          • CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00B04C51
                                                          • _wcslen.LIBCMT ref: 00B04D59
                                                          • CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00B04DCF
                                                          • CoTaskMemFree.OLE32(?), ref: 00B04DDA
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
                                                          • String ID: NULL Pointer assignment
                                                          • API String ID: 614568839-2785691316
                                                          • Opcode ID: 69863e8fd24fd2d9a7fb778132130fd242e086a0110f96377122c0284bd292ff
                                                          • Instruction ID: c089354ce97d44ef83dda7543df6dcda61e58c972502c2e73f3831b6964c32f5
                                                          • Opcode Fuzzy Hash: 69863e8fd24fd2d9a7fb778132130fd242e086a0110f96377122c0284bd292ff
                                                          • Instruction Fuzzy Hash: 1E9108B1D002199FDF14EFA4D891AEEBBB8FF08310F1085AAE515A7291DB709E44CF60
                                                          Function 00B120FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetMenu.USER32(?), ref: 00B12183
                                                          • GetMenuItemCount.USER32(00000000), ref: 00B121B5
                                                          • GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00B121DD
                                                          • _wcslen.LIBCMT ref: 00B12213
                                                          • GetMenuItemID.USER32(?,?), ref: 00B1224D
                                                          • GetSubMenu.USER32(?,?), ref: 00B1225B
                                                            • Part of subcall function 00AE3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00AE3A57
                                                            • Part of subcall function 00AE3A3D: GetCurrentThreadId.KERNEL32 ref: 00AE3A5E
                                                            • Part of subcall function 00AE3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00AE25B3), ref: 00AE3A65
                                                          • PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00B122E3
                                                            • Part of subcall function 00AEE97B: Sleep.KERNEL32 ref: 00AEE9F3
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
                                                          • String ID:
                                                          • API String ID: 4196846111-0
                                                          • Opcode ID: 485a61a2275c3f8f287c7c4bf8b3335a46f53fef894ccf9a28e6001fb97ae194
                                                          • Instruction ID: 428a61531886a0d090a21dd661f797baf87ab8c82afc2ff2e61a53cda697754b
                                                          • Opcode Fuzzy Hash: 485a61a2275c3f8f287c7c4bf8b3335a46f53fef894ccf9a28e6001fb97ae194
                                                          • Instruction Fuzzy Hash: E6718E75A00205AFCB14EF64C985AEEBBF5EF48310F548499E916EB341DB34ED918B90
                                                          Function 00B17E9E Relevance: 10.7, APIs: 7, Instructions: 193windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • IsWindow.USER32(01696788), ref: 00B17F37
                                                          • IsWindowEnabled.USER32(01696788), ref: 00B17F43
                                                          • SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 00B1801E
                                                          • SendMessageW.USER32(01696788,000000B0,?,?), ref: 00B18051
                                                          • IsDlgButtonChecked.USER32(?,?), ref: 00B18089
                                                          • GetWindowLongW.USER32(01696788,000000EC), ref: 00B180AB
                                                          • SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00B180C3
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: MessageSendWindow$ButtonCheckedEnabledLong
                                                          • String ID:
                                                          • API String ID: 4072528602-0
                                                          • Opcode ID: 4f900cc3f5fba26b45ce6f1cf165a0b3afbb412b39a02d648be82b4e7a590ebb
                                                          • Instruction ID: a1a2a3acbe649f9ca54a9358354fcd4493c7c5a70f833c317597be6049a95809
                                                          • Opcode Fuzzy Hash: 4f900cc3f5fba26b45ce6f1cf165a0b3afbb412b39a02d648be82b4e7a590ebb
                                                          • Instruction Fuzzy Hash: 76718C75688244AFEB219F64C884FEB7BF5FF09300F944499E94597261CF31AC86CB50
                                                          Function 00AEAEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetParent.USER32(?), ref: 00AEAEF9
                                                          • GetKeyboardState.USER32(?), ref: 00AEAF0E
                                                          • SetKeyboardState.USER32(?), ref: 00AEAF6F
                                                          • PostMessageW.USER32(?,00000101,00000010,?), ref: 00AEAF9D
                                                          • PostMessageW.USER32(?,00000101,00000011,?), ref: 00AEAFBC
                                                          • PostMessageW.USER32(?,00000101,00000012,?), ref: 00AEAFFD
                                                          • PostMessageW.USER32(?,00000101,0000005B,?), ref: 00AEB020
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: MessagePost$KeyboardState$Parent
                                                          • String ID:
                                                          • API String ID: 87235514-0
                                                          • Opcode ID: ba8c6f9fecfc001594a1366413411907ebc897a0444972a422d9ff3a7f848319
                                                          • Instruction ID: 3dbdad5f087ea29f9fa104131b5a580390b5cf2aaf67f49517f0515b1fcd7677
                                                          • Opcode Fuzzy Hash: ba8c6f9fecfc001594a1366413411907ebc897a0444972a422d9ff3a7f848319
                                                          • Instruction Fuzzy Hash: 2C51D0A06147D53DFB36833A8C49BBBBEE95B06304F088489E1D9468C2C798FCC8D761
                                                          Function 00AEACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetParent.USER32(00000000), ref: 00AEAD19
                                                          • GetKeyboardState.USER32(?), ref: 00AEAD2E
                                                          • SetKeyboardState.USER32(?), ref: 00AEAD8F
                                                          • PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00AEADBB
                                                          • PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00AEADD8
                                                          • PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00AEAE17
                                                          • PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00AEAE38
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: MessagePost$KeyboardState$Parent
                                                          • String ID:
                                                          • API String ID: 87235514-0
                                                          • Opcode ID: e7ad555341498913255d94c54d13815c8b22b13a9a0a411a60532afb442631dd
                                                          • Instruction ID: fb12c8d31b1959c96cba565b666ca97158e4b4c7c0d193f33b8faa075e596704
                                                          • Opcode Fuzzy Hash: e7ad555341498913255d94c54d13815c8b22b13a9a0a411a60532afb442631dd
                                                          • Instruction Fuzzy Hash: 185107A16047E53DFB3383368C95BBABEA95F56300F088488E1D9468C3D794FC88D762
                                                          Function 00AB542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          • GetConsoleCP.KERNEL32(00AC3CD6,?,?,?,?,?,?,?,?,00AB5BA3,?,?,00AC3CD6,?,?), ref: 00AB5470
                                                          • __fassign.LIBCMT ref: 00AB54EB
                                                          • __fassign.LIBCMT ref: 00AB5506
                                                          • WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00AC3CD6,00000005,00000000,00000000), ref: 00AB552C
                                                          • WriteFile.KERNEL32(?,00AC3CD6,00000000,00AB5BA3,00000000,?,?,?,?,?,?,?,?,?,00AB5BA3,?), ref: 00AB554B
                                                          • WriteFile.KERNEL32(?,?,00000001,00AB5BA3,00000000,?,?,?,?,?,?,?,?,?,00AB5BA3,?), ref: 00AB5584
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
                                                          • String ID:
                                                          • API String ID: 1324828854-0
                                                          • Opcode ID: fa206fdd3fc7ee432d339159fceb2e3a9c49637bd79aec5c25fd4a0983ab85f0
                                                          • Instruction ID: f066c3551422a2f8f85cb259e97f9cba160f0bd7057ff639023a0b1fbe1ce307
                                                          • Opcode Fuzzy Hash: fa206fdd3fc7ee432d339159fceb2e3a9c49637bd79aec5c25fd4a0983ab85f0
                                                          • Instruction Fuzzy Hash: A751BF71E00649AFDB20CFA8D885BEEBBF9EF09301F14415AE955E7292D7309A51CB60
                                                          Function 00AA2D20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • _ValidateLocalCookies.LIBCMT ref: 00AA2D4B
                                                          • ___except_validate_context_record.LIBVCRUNTIME ref: 00AA2D53
                                                          • _ValidateLocalCookies.LIBCMT ref: 00AA2DE1
                                                          • __IsNonwritableInCurrentImage.LIBCMT ref: 00AA2E0C
                                                          • _ValidateLocalCookies.LIBCMT ref: 00AA2E61
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                          • String ID: csm
                                                          • API String ID: 1170836740-1018135373
                                                          • Opcode ID: f364b4f7cbfa69832d9600beae3845694824d17409871ef0639f5791381c6564
                                                          • Instruction ID: a27f7aecd0757d635e92c0fd1b71d632f79d56c5594d406691bf2b13e19bd828
                                                          • Opcode Fuzzy Hash: f364b4f7cbfa69832d9600beae3845694824d17409871ef0639f5791381c6564
                                                          • Instruction Fuzzy Hash: 7B419134A01209ABCF10DF6CC845BAEBBB5BF46324F148155E8146B3E2DB35EE65CB90
                                                          Function 00B010B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00B0304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00B0307A
                                                            • Part of subcall function 00B0304E: _wcslen.LIBCMT ref: 00B0309B
                                                          • socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00B01112
                                                          • WSAGetLastError.WSOCK32 ref: 00B01121
                                                          • WSAGetLastError.WSOCK32 ref: 00B011C9
                                                          • closesocket.WSOCK32(00000000), ref: 00B011F9
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
                                                          • String ID:
                                                          • API String ID: 2675159561-0
                                                          • Opcode ID: 28f7e58d1beb436bb77a438190dc4603ae59e685b0ef43ae1c8014a078c844ff
                                                          • Instruction ID: 1f199bc151f6ded3ae336795f167eccd753475120e141b9509c1d88307ea698d
                                                          • Opcode Fuzzy Hash: 28f7e58d1beb436bb77a438190dc4603ae59e685b0ef43ae1c8014a078c844ff
                                                          • Instruction Fuzzy Hash: 5241D431600204AFDB189F18C885BAABFE9FF45364F148499F916AB2D1CB70ED41CBE1
                                                          Function 00AECF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00AEDDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00AECF22,?), ref: 00AEDDFD
                                                            • Part of subcall function 00AEDDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00AECF22,?), ref: 00AEDE16
                                                          • lstrcmpiW.KERNEL32(?,?), ref: 00AECF45
                                                          • MoveFileW.KERNEL32(?,?), ref: 00AECF7F
                                                          • _wcslen.LIBCMT ref: 00AED005
                                                          • _wcslen.LIBCMT ref: 00AED01B
                                                          • SHFileOperationW.SHELL32(?), ref: 00AED061
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
                                                          • String ID: \*.*
                                                          • API String ID: 3164238972-1173974218
                                                          • Opcode ID: 263831deb5bf0131bcc677008a724b29a93534d833894c63ce08835ed37eea54
                                                          • Instruction ID: 630c379226dab82280476a5adb9bb0ed34fa9da337709ac16b8dd744e3fdd157
                                                          • Opcode Fuzzy Hash: 263831deb5bf0131bcc677008a724b29a93534d833894c63ce08835ed37eea54
                                                          • Instruction Fuzzy Hash: D04166719452585FDF12EFA5CA81ADEB7B9AF08380F0000E6E505EB142EB34AB89CB50
                                                          Function 00B12DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00B12E1C
                                                          • GetWindowLongW.USER32(?,000000F0), ref: 00B12E4F
                                                          • GetWindowLongW.USER32(?,000000F0), ref: 00B12E84
                                                          • SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00B12EB6
                                                          • SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00B12EE0
                                                          • GetWindowLongW.USER32(?,000000F0), ref: 00B12EF1
                                                          • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00B12F0B
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: LongWindow$MessageSend
                                                          • String ID:
                                                          • API String ID: 2178440468-0
                                                          • Opcode ID: 81873ccef01359d34b1cdbc889ed0cb849a4c38e3b76feb794657f5c0584c1c7
                                                          • Instruction ID: 77902a1c814d46a161814715da69112ae71d8bc077161537370991ef7349f97a
                                                          • Opcode Fuzzy Hash: 81873ccef01359d34b1cdbc889ed0cb849a4c38e3b76feb794657f5c0584c1c7
                                                          • Instruction Fuzzy Hash: A8311232644250AFEB21CF58DC85FA53BE1FB9A711F9541A4F9108F2B2CB71ACA1DB41
                                                          Function 00AE7726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00AE7769
                                                          • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00AE778F
                                                          • SysAllocString.OLEAUT32(00000000), ref: 00AE7792
                                                          • SysAllocString.OLEAUT32(?), ref: 00AE77B0
                                                          • SysFreeString.OLEAUT32(?), ref: 00AE77B9
                                                          • StringFromGUID2.OLE32(?,?,00000028), ref: 00AE77DE
                                                          • SysAllocString.OLEAUT32(?), ref: 00AE77EC
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                                          • String ID:
                                                          • API String ID: 3761583154-0
                                                          • Opcode ID: 35ba9e41d4fcb80e283c9e32e80c1c689aa3c3967eb6f4f9a673306ce70a7588
                                                          • Instruction ID: 84bb08ac18b8dc18ce65f7d0c89e6bfbd3949054e2b3476f448f9838ec28f384
                                                          • Opcode Fuzzy Hash: 35ba9e41d4fcb80e283c9e32e80c1c689aa3c3967eb6f4f9a673306ce70a7588
                                                          • Instruction Fuzzy Hash: 1D219076608219AFDF10DFA9CC88CFF77ACEB097647448025FA15DB250DA70DC428764
                                                          Function 00AE77FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00AE7842
                                                          • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00AE7868
                                                          • SysAllocString.OLEAUT32(00000000), ref: 00AE786B
                                                          • SysAllocString.OLEAUT32 ref: 00AE788C
                                                          • SysFreeString.OLEAUT32 ref: 00AE7895
                                                          • StringFromGUID2.OLE32(?,?,00000028), ref: 00AE78AF
                                                          • SysAllocString.OLEAUT32(?), ref: 00AE78BD
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                                          • String ID:
                                                          • API String ID: 3761583154-0
                                                          • Opcode ID: 9a8a64ae4f524b9746d338c73b62f54546c05dc074707a9bd2dd8df83a1bf81c
                                                          • Instruction ID: eb428820d84f8d62cfa07c556135f6b935c922cd7f65c13209f9166b80628179
                                                          • Opcode Fuzzy Hash: 9a8a64ae4f524b9746d338c73b62f54546c05dc074707a9bd2dd8df83a1bf81c
                                                          • Instruction Fuzzy Hash: 4821AF76608214AFEF10AFA9DC88DAE77ECEB193607508125F915CB2A1DA70DC81CB64
                                                          Function 00AF04D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetStdHandle.KERNEL32(0000000C), ref: 00AF04F2
                                                          • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00AF052E
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: CreateHandlePipe
                                                          • String ID: nul
                                                          • API String ID: 1424370930-2873401336
                                                          • Opcode ID: f8a4e94e81c2bd6d9eedaa15f8cb8d0c1d57e7942e27c82f6cfb083be23b9c5b
                                                          • Instruction ID: cf5a795d7368619755e09b2de4a500693898e33b10ff1d0b08a81421ad8ad00d
                                                          • Opcode Fuzzy Hash: f8a4e94e81c2bd6d9eedaa15f8cb8d0c1d57e7942e27c82f6cfb083be23b9c5b
                                                          • Instruction Fuzzy Hash: BA216075500309ABDF209FA9DC44EAA7BB4AF44764F208A19FAA1D72E1D7B0D940CF60
                                                          Function 00AF05A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetStdHandle.KERNEL32(000000F6), ref: 00AF05C6
                                                          • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00AF0601
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: CreateHandlePipe
                                                          • String ID: nul
                                                          • API String ID: 1424370930-2873401336
                                                          • Opcode ID: 3cb54f6b65b03e851ec099d0b02fa1968b5cbfed21e389d913a0ed84a343990c
                                                          • Instruction ID: 9c3ea0ed3394fa2f867e2547f34b14bcc45af6e81a789f9dda77291a1a07a7e7
                                                          • Opcode Fuzzy Hash: 3cb54f6b65b03e851ec099d0b02fa1968b5cbfed21e389d913a0ed84a343990c
                                                          • Instruction Fuzzy Hash: 2321A6755003199BDB208FA88C04EAA7BE4AF95760F204B19FAA1E72D1DBF09960CB50
                                                          Function 00B140AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00A8600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00A8604C
                                                            • Part of subcall function 00A8600E: GetStockObject.GDI32(00000011), ref: 00A86060
                                                            • Part of subcall function 00A8600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 00A8606A
                                                          • SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00B14112
                                                          • SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00B1411F
                                                          • SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00B1412A
                                                          • SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00B14139
                                                          • SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00B14145
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$CreateObjectStockWindow
                                                          • String ID: Msctls_Progress32
                                                          • API String ID: 1025951953-3636473452
                                                          • Opcode ID: 6b25d1206ab618c745eca03cf022429a10d589f70d423fd37611b0a4be0c7688
                                                          • Instruction ID: b15544229e22a3b1cf830a8621630e5c4b61ace8272b9ee0962aa6c5693e0d84
                                                          • Opcode Fuzzy Hash: 6b25d1206ab618c745eca03cf022429a10d589f70d423fd37611b0a4be0c7688
                                                          • Instruction Fuzzy Hash: CB11B2B2140219BEEF119F64CC85EE77FADEF09798F008110BB18A6050CB729C61DBA4
                                                          Function 00ABD7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00ABD7A3: _free.LIBCMT ref: 00ABD7CC
                                                          • _free.LIBCMT ref: 00ABD82D
                                                            • Part of subcall function 00AB29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00ABD7D1,00000000,00000000,00000000,00000000,?,00ABD7F8,00000000,00000007,00000000,?,00ABDBF5,00000000), ref: 00AB29DE
                                                            • Part of subcall function 00AB29C8: GetLastError.KERNEL32(00000000,?,00ABD7D1,00000000,00000000,00000000,00000000,?,00ABD7F8,00000000,00000007,00000000,?,00ABDBF5,00000000,00000000), ref: 00AB29F0
                                                          • _free.LIBCMT ref: 00ABD838
                                                          • _free.LIBCMT ref: 00ABD843
                                                          • _free.LIBCMT ref: 00ABD897
                                                          • _free.LIBCMT ref: 00ABD8A2
                                                          • _free.LIBCMT ref: 00ABD8AD
                                                          • _free.LIBCMT ref: 00ABD8B8
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: _free$ErrorFreeHeapLast
                                                          • String ID:
                                                          • API String ID: 776569668-0
                                                          • Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
                                                          • Instruction ID: 7627fd8b8bcd8941fe5ba718860ee3779f140c146e87d6a7afa717973869af4d
                                                          • Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
                                                          • Instruction Fuzzy Hash: 75111971940B44BBDA21BFB0CE47FCB7BDCAF44700F404C26B29DAA493EA65B5458760
                                                          Function 00AEDA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00AEDA74
                                                          • LoadStringW.USER32(00000000), ref: 00AEDA7B
                                                          • GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00AEDA91
                                                          • LoadStringW.USER32(00000000), ref: 00AEDA98
                                                          • MessageBoxW.USER32(00000000,?,?,00011010), ref: 00AEDADC
                                                          Strings
                                                          • %s (%d) : ==> %s: %s %s, xrefs: 00AEDAB9
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: HandleLoadModuleString$Message
                                                          • String ID: %s (%d) : ==> %s: %s %s
                                                          • API String ID: 4072794657-3128320259
                                                          • Opcode ID: dd6d765ffd23e42e18eeb817ebee24edf15613813ed4c132a0b94322fc60e90c
                                                          • Instruction ID: 2e4d3e51758aa231a855a3f2bf5cdcbf1c297741e10022ec7a318b1867509af5
                                                          • Opcode Fuzzy Hash: dd6d765ffd23e42e18eeb817ebee24edf15613813ed4c132a0b94322fc60e90c
                                                          • Instruction Fuzzy Hash: E50186F6540208BFEB509BA09D89EE7377CE708701F8044A1B706E7041EA749E844F74
                                                          Function 00AF096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • InterlockedExchange.KERNEL32(0168F088,0168F088), ref: 00AF097B
                                                          • EnterCriticalSection.KERNEL32(0168F068,00000000), ref: 00AF098D
                                                          • TerminateThread.KERNEL32(?,000001F6), ref: 00AF099B
                                                          • WaitForSingleObject.KERNEL32(?,000003E8), ref: 00AF09A9
                                                          • CloseHandle.KERNEL32(?), ref: 00AF09B8
                                                          • InterlockedExchange.KERNEL32(0168F088,000001F6), ref: 00AF09C8
                                                          • LeaveCriticalSection.KERNEL32(0168F068), ref: 00AF09CF
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
                                                          • String ID:
                                                          • API String ID: 3495660284-0
                                                          • Opcode ID: d4bda4307dfd8225ac81e3488e2a2616df72073150d6d2584b05e4b350e12ae9
                                                          • Instruction ID: 361feb85cf4f31612c2f9905d5574ac0df9effc2aa8d9a28d04e8e07098a81bf
                                                          • Opcode Fuzzy Hash: d4bda4307dfd8225ac81e3488e2a2616df72073150d6d2584b05e4b350e12ae9
                                                          • Instruction Fuzzy Hash: 05F01D31482612BBD7515B94EE88AE67E35BF01702F905015F201518A1DB749465CF90
                                                          Function 00A85D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetClientRect.USER32(?,?), ref: 00A85D30
                                                          • GetWindowRect.USER32(?,?), ref: 00A85D71
                                                          • ScreenToClient.USER32(?,?), ref: 00A85D99
                                                          • GetClientRect.USER32(?,?), ref: 00A85ED7
                                                          • GetWindowRect.USER32(?,?), ref: 00A85EF8
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Rect$Client$Window$Screen
                                                          • String ID:
                                                          • API String ID: 1296646539-0
                                                          • Opcode ID: 4c233fb6629d74862b0a701bd72164863af2e2690482cc56f11ed31ca63cde6b
                                                          • Instruction ID: a296f5ab2ebc63c359e720453230cc4568dea249bef8ae05a6ff688dd7ebf28f
                                                          • Opcode Fuzzy Hash: 4c233fb6629d74862b0a701bd72164863af2e2690482cc56f11ed31ca63cde6b
                                                          • Instruction Fuzzy Hash: DEB15835A00A4ADBDB14DFB9C880BEAB7F1FF58310F14841AECA9D7250DB34AA51DB54
                                                          Function 00AB01B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • __allrem.LIBCMT ref: 00AB00BA
                                                          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00AB00D6
                                                          • __allrem.LIBCMT ref: 00AB00ED
                                                          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00AB010B
                                                          • __allrem.LIBCMT ref: 00AB0122
                                                          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00AB0140
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
                                                          • String ID:
                                                          • API String ID: 1992179935-0
                                                          • Opcode ID: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
                                                          • Instruction ID: c40d3176f160e4d1aa8a065752494190d0be2c4929efa6c321be3b223aa06877
                                                          • Opcode Fuzzy Hash: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
                                                          • Instruction Fuzzy Hash: 0A81C472A007069FE728AB68DD41FAB73EDAF42364F24462EF551D76C2E7B0D9008790
                                                          Function 00B01D10 Relevance: 9.3, APIs: 6, Instructions: 254networkCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00B03149: select.WSOCK32(00000000,?,00000000,00000000,?,?,?,00000000,?,?,?,00B0101C,00000000,?,?,00000000), ref: 00B03195
                                                          • __WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00B01DC0
                                                          • #17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00B01DE1
                                                          • WSAGetLastError.WSOCK32 ref: 00B01DF2
                                                          • inet_ntoa.WSOCK32(?), ref: 00B01E8C
                                                          • htons.WSOCK32(?,?,?,?,?), ref: 00B01EDB
                                                          • _strlen.LIBCMT ref: 00B01F35
                                                            • Part of subcall function 00AE39E8: _strlen.LIBCMT ref: 00AE39F2
                                                            • Part of subcall function 00A86D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000002,?,?,?,?,00A9CF58,?,?,?), ref: 00A86DBA
                                                            • Part of subcall function 00A86D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,?,?,?,00A9CF58,?,?,?), ref: 00A86DED
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: ByteCharMultiWide_strlen$ErrorLasthtonsinet_ntoaselect
                                                          • String ID:
                                                          • API String ID: 1923757996-0
                                                          • Opcode ID: da20ed25ecfd6ff241e7311274eed46393249ab6cef891c4a483100f201ecbae
                                                          • Instruction ID: 71880350eff5d1d0e6000fe77fb18ffa9a74f4a01d51babe0b216f5851ef9706
                                                          • Opcode Fuzzy Hash: da20ed25ecfd6ff241e7311274eed46393249ab6cef891c4a483100f201ecbae
                                                          • Instruction Fuzzy Hash: B0A1E031204341AFD728EF28C895E2A7BE5EF85318F54899CF4565B2E2DB31ED42CB91
                                                          Function 00AB61FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00AA82D9,00AA82D9,?,?,?,00AB644F,00000001,00000001,8BE85006), ref: 00AB6258
                                                          • MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00AB644F,00000001,00000001,8BE85006,?,?,?), ref: 00AB62DE
                                                          • WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00AB63D8
                                                          • __freea.LIBCMT ref: 00AB63E5
                                                            • Part of subcall function 00AB3820: RtlAllocateHeap.NTDLL(00000000,?,00B51444,?,00A9FDF5,?,?,00A8A976,00000010,00B51440,00A813FC,?,00A813C6,?,00A81129), ref: 00AB3852
                                                          • __freea.LIBCMT ref: 00AB63EE
                                                          • __freea.LIBCMT ref: 00AB6413
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: ByteCharMultiWide__freea$AllocateHeap
                                                          • String ID:
                                                          • API String ID: 1414292761-0
                                                          • Opcode ID: a36dfd9f7c267c8a35026dabae8843c3ff91ac0ef5b1734827786e8a4b91b463
                                                          • Instruction ID: e15b9b5736a8dc993ab518367dae161aa0cbe93eefd0493466eb608c9497cf49
                                                          • Opcode Fuzzy Hash: a36dfd9f7c267c8a35026dabae8843c3ff91ac0ef5b1734827786e8a4b91b463
                                                          • Instruction Fuzzy Hash: E551BF72A00216ABEB258F64DD81EEF7BADEB44750F154629FC05DB142EB38DC54C6A0
                                                          Function 00B0BBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00A89CB3: _wcslen.LIBCMT ref: 00A89CBD
                                                            • Part of subcall function 00B0C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00B0B6AE,?,?), ref: 00B0C9B5
                                                            • Part of subcall function 00B0C998: _wcslen.LIBCMT ref: 00B0C9F1
                                                            • Part of subcall function 00B0C998: _wcslen.LIBCMT ref: 00B0CA68
                                                            • Part of subcall function 00B0C998: _wcslen.LIBCMT ref: 00B0CA9E
                                                          • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00B0BCCA
                                                          • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00B0BD25
                                                          • RegCloseKey.ADVAPI32(00000000), ref: 00B0BD6A
                                                          • RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00B0BD99
                                                          • RegCloseKey.ADVAPI32(?,?,00000000), ref: 00B0BDF3
                                                          • RegCloseKey.ADVAPI32(?), ref: 00B0BDFF
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
                                                          • String ID:
                                                          • API String ID: 1120388591-0
                                                          • Opcode ID: f618e1341612f9d9de25ac77afb7b7f9a1b7036680dca3f642829a14b3fde604
                                                          • Instruction ID: bfef971cf8a59749b392cbe099a489505d3302fa8fdf688503875b14c8b6dfa4
                                                          • Opcode Fuzzy Hash: f618e1341612f9d9de25ac77afb7b7f9a1b7036680dca3f642829a14b3fde604
                                                          • Instruction Fuzzy Hash: 1481C430208241EFD714DF24C885E6ABBE5FF84308F1489ACF4598B2A2DB31ED45CB92
                                                          Function 00ADF7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • VariantInit.OLEAUT32(00000035), ref: 00ADF7B9
                                                          • SysAllocString.OLEAUT32(00000001), ref: 00ADF860
                                                          • VariantCopy.OLEAUT32(00ADFA64,00000000), ref: 00ADF889
                                                          • VariantClear.OLEAUT32(00ADFA64), ref: 00ADF8AD
                                                          • VariantCopy.OLEAUT32(00ADFA64,00000000), ref: 00ADF8B1
                                                          • VariantClear.OLEAUT32(?), ref: 00ADF8BB
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Variant$ClearCopy$AllocInitString
                                                          • String ID:
                                                          • API String ID: 3859894641-0
                                                          • Opcode ID: 8c3024e5a9792dff622c09dc58c1aab861d285fdae632426337179d88f9b1426
                                                          • Instruction ID: b8c84c0dbe44eaee2a14ef51fd4ab6fa1c41c7981546c64fbed2b833c6b4f750
                                                          • Opcode Fuzzy Hash: 8c3024e5a9792dff622c09dc58c1aab861d285fdae632426337179d88f9b1426
                                                          • Instruction Fuzzy Hash: DE51C231A50310BECF24AB65D8A5B3AB3E8EF45710B248467E907DF391DB708D40CBA6
                                                          Function 00AF910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00A87620: _wcslen.LIBCMT ref: 00A87625
                                                            • Part of subcall function 00A86B57: _wcslen.LIBCMT ref: 00A86B6A
                                                          • GetOpenFileNameW.COMDLG32(00000058), ref: 00AF94E5
                                                          • _wcslen.LIBCMT ref: 00AF9506
                                                          • _wcslen.LIBCMT ref: 00AF952D
                                                          • GetSaveFileNameW.COMDLG32(00000058), ref: 00AF9585
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: _wcslen$FileName$OpenSave
                                                          • String ID: X
                                                          • API String ID: 83654149-3081909835
                                                          • Opcode ID: f6ca1be2485bba6bf626cf0aa3408f529fb8cad35d2d8c3453c547c294d7a379
                                                          • Instruction ID: 1ab59cdafdf72a0c5e6b07afcb10d17dc82c285870e0fc96e0b1b5a3dffb7b48
                                                          • Opcode Fuzzy Hash: f6ca1be2485bba6bf626cf0aa3408f529fb8cad35d2d8c3453c547c294d7a379
                                                          • Instruction Fuzzy Hash: 12E1BE716083018FD724EF64C981B6BB7E4BF85314F04896DF9999B2A2DB31ED05CB92
                                                          Function 00A9920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00A99BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00A99BB2
                                                          • BeginPaint.USER32(?,?,?), ref: 00A99241
                                                          • GetWindowRect.USER32(?,?), ref: 00A992A5
                                                          • ScreenToClient.USER32(?,?), ref: 00A992C2
                                                          • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00A992D3
                                                          • EndPaint.USER32(?,?,?,?,?), ref: 00A99321
                                                          • Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00AD71EA
                                                            • Part of subcall function 00A99339: BeginPath.GDI32(00000000), ref: 00A99357
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
                                                          • String ID:
                                                          • API String ID: 3050599898-0
                                                          • Opcode ID: 9fd3a12844867f5b1613da075d0c29b5eceb05cc9f1432b3f1db015d4bd30d54
                                                          • Instruction ID: 0aaae6c153c77d77c89dd1fac1154679ba30404478267c87f6536bedd8b11ca5
                                                          • Opcode Fuzzy Hash: 9fd3a12844867f5b1613da075d0c29b5eceb05cc9f1432b3f1db015d4bd30d54
                                                          • Instruction Fuzzy Hash: 9D418E70204300AFDB21DF28C885FAB7BF8EB56321F14066DF9558B2B1DB719846DB61
                                                          Function 00AF07EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • InterlockedExchange.KERNEL32(?,000001F5), ref: 00AF080C
                                                          • ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 00AF0847
                                                          • EnterCriticalSection.KERNEL32(?), ref: 00AF0863
                                                          • LeaveCriticalSection.KERNEL32(?), ref: 00AF08DC
                                                          • ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 00AF08F3
                                                          • InterlockedExchange.KERNEL32(?,000001F6), ref: 00AF0921
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
                                                          • String ID:
                                                          • API String ID: 3368777196-0
                                                          • Opcode ID: 1a0f7c64df1e41d85a852338bca244240f2ed4cb8d2f2f611691b018554d9656
                                                          • Instruction ID: 6423b650f4bdd81d1de55846323c92d5b5a7fdb15cd712697b960d6420d9cf20
                                                          • Opcode Fuzzy Hash: 1a0f7c64df1e41d85a852338bca244240f2ed4cb8d2f2f611691b018554d9656
                                                          • Instruction Fuzzy Hash: 2B415971A00209AFDF14AF94DC85AAA77B8FF04310F1480A5ED00AB297DB30DE64DBA4
                                                          Function 00B181DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,00ADF3AB,00000000,?,?,00000000,?,00AD682C,00000004,00000000,00000000), ref: 00B1824C
                                                          • EnableWindow.USER32(?,00000000), ref: 00B18272
                                                          • ShowWindow.USER32(FFFFFFFF,00000000), ref: 00B182D1
                                                          • ShowWindow.USER32(?,00000004), ref: 00B182E5
                                                          • EnableWindow.USER32(?,00000001), ref: 00B1830B
                                                          • SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 00B1832F
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Window$Show$Enable$MessageSend
                                                          • String ID:
                                                          • API String ID: 642888154-0
                                                          • Opcode ID: 9eb161576aa122233e778abd93b8c5735db7aa5f597dfea22672cb43aacef142
                                                          • Instruction ID: c2c1a99d1786e1c9f2797adc249fbbc96541d1c84396b6f178d6509a1695d069
                                                          • Opcode Fuzzy Hash: 9eb161576aa122233e778abd93b8c5735db7aa5f597dfea22672cb43aacef142
                                                          • Instruction Fuzzy Hash: 8A41B234601644EFDB22CF18D899BE47BE0FB4A715F5841E9F5184B2A2CB71AC81CF90
                                                          Function 00AE4C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • IsWindowVisible.USER32(?), ref: 00AE4C95
                                                          • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00AE4CB2
                                                          • SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00AE4CEA
                                                          • _wcslen.LIBCMT ref: 00AE4D08
                                                          • CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00AE4D10
                                                          • _wcsstr.LIBVCRUNTIME ref: 00AE4D1A
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
                                                          • String ID:
                                                          • API String ID: 72514467-0
                                                          • Opcode ID: 5b59c9af64a9ce9d97ab3e0e7b81af8d400303ee24b38ad3cc75d61e384f66c2
                                                          • Instruction ID: 28eadf9c1aa6a141ad4e89bddae15ed639b47a8997e4fa5e9467c5744639a5ae
                                                          • Opcode Fuzzy Hash: 5b59c9af64a9ce9d97ab3e0e7b81af8d400303ee24b38ad3cc75d61e384f66c2
                                                          • Instruction Fuzzy Hash: C921C9716042447FEB155B3A9D49E7B7FACDF49750F108029F805CB191DE65DC4196A0
                                                          Function 00AF581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00A83AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00A83A97,?,?,00A82E7F,?,?,?,00000000), ref: 00A83AC2
                                                          • _wcslen.LIBCMT ref: 00AF587B
                                                          • CoInitialize.OLE32(00000000), ref: 00AF5995
                                                          • CoCreateInstance.OLE32(00B1FCF8,00000000,00000001,00B1FB68,?), ref: 00AF59AE
                                                          • CoUninitialize.OLE32 ref: 00AF59CC
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
                                                          • String ID: .lnk
                                                          • API String ID: 3172280962-24824748
                                                          • Opcode ID: f2982e31b4c69858720ba3ff7d09a7539d4775937a9dc4c5bd2ccf35576ff670
                                                          • Instruction ID: d425a1a16560f935cb02dae4504f06f652ac21328d55d758e547e0223683ff4c
                                                          • Opcode Fuzzy Hash: f2982e31b4c69858720ba3ff7d09a7539d4775937a9dc4c5bd2ccf35576ff670
                                                          • Instruction Fuzzy Hash: 9CD17471A087059FC718EF64C58492ABBE1FF89710F14885DFA8A9B361DB31EC45CB92
                                                          Function 00AE175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00AE0FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00AE0FCA
                                                            • Part of subcall function 00AE0FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00AE0FD6
                                                            • Part of subcall function 00AE0FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00AE0FE5
                                                            • Part of subcall function 00AE0FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00AE0FEC
                                                            • Part of subcall function 00AE0FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00AE1002
                                                          • GetLengthSid.ADVAPI32(?,00000000,00AE1335), ref: 00AE17AE
                                                          • GetProcessHeap.KERNEL32(00000008,00000000), ref: 00AE17BA
                                                          • HeapAlloc.KERNEL32(00000000), ref: 00AE17C1
                                                          • CopySid.ADVAPI32(00000000,00000000,?), ref: 00AE17DA
                                                          • GetProcessHeap.KERNEL32(00000000,00000000,00AE1335), ref: 00AE17EE
                                                          • HeapFree.KERNEL32(00000000), ref: 00AE17F5
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
                                                          • String ID:
                                                          • API String ID: 3008561057-0
                                                          • Opcode ID: 12e4c4722c1c92fab6fbc71cc2f0c107dc39fb726de4470648b4e202a8632fb4
                                                          • Instruction ID: c3ba629bd7b4458a00da76b2ff7d42c035f21ca432366961c7feffd39e327245
                                                          • Opcode Fuzzy Hash: 12e4c4722c1c92fab6fbc71cc2f0c107dc39fb726de4470648b4e202a8632fb4
                                                          • Instruction Fuzzy Hash: 51118B32684215FFDB109FA5CC49FEE7BB9EB46755F608018F981A7210DB36A944CF60
                                                          Function 00AE14CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00AE14FF
                                                          • OpenProcessToken.ADVAPI32(00000000), ref: 00AE1506
                                                          • CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00AE1515
                                                          • CloseHandle.KERNEL32(00000004), ref: 00AE1520
                                                          • CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00AE154F
                                                          • DestroyEnvironmentBlock.USERENV(00000000), ref: 00AE1563
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
                                                          • String ID:
                                                          • API String ID: 1413079979-0
                                                          • Opcode ID: 83920c9b7897d048b4356cc22c68426079c3debc72a956854f4563c64e8865bb
                                                          • Instruction ID: 945887c71a6d70925096ce95ec89b4994816fffcb644aba296a4dd3df7d57272
                                                          • Opcode Fuzzy Hash: 83920c9b7897d048b4356cc22c68426079c3debc72a956854f4563c64e8865bb
                                                          • Instruction Fuzzy Hash: 6F1129B2540259ABDF118F98ED49FDE7BB9EF48744F048015FA05A21A0C7758E60DB60
                                                          Function 00AA3382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          • GetLastError.KERNEL32(?,?,00AA3379,00AA2FE5), ref: 00AA3390
                                                          • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00AA339E
                                                          • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00AA33B7
                                                          • SetLastError.KERNEL32(00000000,?,00AA3379,00AA2FE5), ref: 00AA3409
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: ErrorLastValue___vcrt_
                                                          • String ID:
                                                          • API String ID: 3852720340-0
                                                          • Opcode ID: 1ebd5adaa1846b87de893f44b898eb5016335ba632c02ba1b3ab8ebbe6cbdd2c
                                                          • Instruction ID: 6c8d6fb14b0c67852ee7375bd3d4fadcdca05d0821f8ec4240137f9be1e236f0
                                                          • Opcode Fuzzy Hash: 1ebd5adaa1846b87de893f44b898eb5016335ba632c02ba1b3ab8ebbe6cbdd2c
                                                          • Instruction Fuzzy Hash: 1701473760E311BFAEA62B747D856672E94EB0B7793300229F4208B2F0EF114E015154
                                                          Function 00AB2D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          • GetLastError.KERNEL32(?,?,00AB5686,00AC3CD6,?,00000000,?,00AB5B6A,?,?,?,?,?,00AAE6D1,?,00B48A48), ref: 00AB2D78
                                                          • _free.LIBCMT ref: 00AB2DAB
                                                          • _free.LIBCMT ref: 00AB2DD3
                                                          • SetLastError.KERNEL32(00000000,?,?,?,?,00AAE6D1,?,00B48A48,00000010,00A84F4A,?,?,00000000,00AC3CD6), ref: 00AB2DE0
                                                          • SetLastError.KERNEL32(00000000,?,?,?,?,00AAE6D1,?,00B48A48,00000010,00A84F4A,?,?,00000000,00AC3CD6), ref: 00AB2DEC
                                                          • _abort.LIBCMT ref: 00AB2DF2
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: ErrorLast$_free$_abort
                                                          • String ID:
                                                          • API String ID: 3160817290-0
                                                          • Opcode ID: 6e9edf97d93757539281170bd7e729507c9dd3201178a7f9d6cd1acd5b1162c0
                                                          • Instruction ID: fc5930b48c97609acc16879e1a26d36a835b27104895df6986ab3881421357a5
                                                          • Opcode Fuzzy Hash: 6e9edf97d93757539281170bd7e729507c9dd3201178a7f9d6cd1acd5b1162c0
                                                          • Instruction Fuzzy Hash: 32F0C83654560027D6123738BD0AFEA2B6DBFC67A1F24451AF824931D7EE3489014360
                                                          Function 00B18A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00A99639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00A99693
                                                            • Part of subcall function 00A99639: SelectObject.GDI32(?,00000000), ref: 00A996A2
                                                            • Part of subcall function 00A99639: BeginPath.GDI32(?), ref: 00A996B9
                                                            • Part of subcall function 00A99639: SelectObject.GDI32(?,00000000), ref: 00A996E2
                                                          • MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00B18A4E
                                                          • LineTo.GDI32(?,00000003,00000000), ref: 00B18A62
                                                          • MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00B18A70
                                                          • LineTo.GDI32(?,00000000,00000003), ref: 00B18A80
                                                          • EndPath.GDI32(?), ref: 00B18A90
                                                          • StrokePath.GDI32(?), ref: 00B18AA0
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Path$LineMoveObjectSelect$BeginCreateStroke
                                                          • String ID:
                                                          • API String ID: 43455801-0
                                                          • Opcode ID: 2bbfb1e3c53164749ed2953778e1006540d263323ffda9cbb104f7d9253ebba0
                                                          • Instruction ID: 84d33a33dad3f9b984e26e50338a38f40026862de4b134c3f8943c8ec6edfae0
                                                          • Opcode Fuzzy Hash: 2bbfb1e3c53164749ed2953778e1006540d263323ffda9cbb104f7d9253ebba0
                                                          • Instruction Fuzzy Hash: 3B11F776040108FFDB129F94DC88FEA7FACEB08350F40C462BA199A1A1CB719D55DBA0
                                                          Function 00AE51FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetDC.USER32(00000000), ref: 00AE5218
                                                          • GetDeviceCaps.GDI32(00000000,00000058), ref: 00AE5229
                                                          • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00AE5230
                                                          • ReleaseDC.USER32(00000000,00000000), ref: 00AE5238
                                                          • MulDiv.KERNEL32(000009EC,?,00000000), ref: 00AE524F
                                                          • MulDiv.KERNEL32(000009EC,00000001,?), ref: 00AE5261
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: CapsDevice$Release
                                                          • String ID:
                                                          • API String ID: 1035833867-0
                                                          • Opcode ID: 261d303609e92646e519b46b81605d9c0a9ed2c6f305f5d72ddbc819b889ee1d
                                                          • Instruction ID: 8fa66d471bd509ebbdff77d62cd3610dad0281bd6ea62a542d527ecc60670c79
                                                          • Opcode Fuzzy Hash: 261d303609e92646e519b46b81605d9c0a9ed2c6f305f5d72ddbc819b889ee1d
                                                          • Instruction Fuzzy Hash: 85014475E40714BBEB105BB69C49A9EBF78EF48751F148065FA05E7281DA709900CB60
                                                          Function 00A81BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • MapVirtualKeyW.USER32(0000005B,00000000), ref: 00A81BF4
                                                          • MapVirtualKeyW.USER32(00000010,00000000), ref: 00A81BFC
                                                          • MapVirtualKeyW.USER32(000000A0,00000000), ref: 00A81C07
                                                          • MapVirtualKeyW.USER32(000000A1,00000000), ref: 00A81C12
                                                          • MapVirtualKeyW.USER32(00000011,00000000), ref: 00A81C1A
                                                          • MapVirtualKeyW.USER32(00000012,00000000), ref: 00A81C22
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Virtual
                                                          • String ID:
                                                          • API String ID: 4278518827-0
                                                          • Opcode ID: 580f707b4b934048841ed907b1f485c34641248c53dbebaa8d6ba2310df5f25b
                                                          • Instruction ID: cbda5377ca47c1bfd8ac3a91766ede3dec1dcee5a3b9916193161a64f873b013
                                                          • Opcode Fuzzy Hash: 580f707b4b934048841ed907b1f485c34641248c53dbebaa8d6ba2310df5f25b
                                                          • Instruction Fuzzy Hash: 7D0167B0942B5ABDE3008F6A8C85B52FFA8FF19354F00411BA15C4BA42C7F5A864CBE5
                                                          Function 00AEEB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00AEEB30
                                                          • SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00AEEB46
                                                          • GetWindowThreadProcessId.USER32(?,?), ref: 00AEEB55
                                                          • OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00AEEB64
                                                          • TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00AEEB6E
                                                          • CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00AEEB75
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
                                                          • String ID:
                                                          • API String ID: 839392675-0
                                                          • Opcode ID: 6576059906f0f0cd4a84e9046b05536280f522b40756dfb6f9dca5dfb1630777
                                                          • Instruction ID: b271a851385e8b2faa98fbd964a4a30fe020b89b791adaa439d2e83a19ea91bf
                                                          • Opcode Fuzzy Hash: 6576059906f0f0cd4a84e9046b05536280f522b40756dfb6f9dca5dfb1630777
                                                          • Instruction Fuzzy Hash: D1F03072680158BBE72157529C0DEEF3E7CEFCAB11F408158F611E3091DBA05A01C6B5
                                                          Function 00AD7439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetClientRect.USER32(?), ref: 00AD7452
                                                          • SendMessageW.USER32(?,00001328,00000000,?), ref: 00AD7469
                                                          • GetWindowDC.USER32(?), ref: 00AD7475
                                                          • GetPixel.GDI32(00000000,?,?), ref: 00AD7484
                                                          • ReleaseDC.USER32(?,00000000), ref: 00AD7496
                                                          • GetSysColor.USER32(00000005), ref: 00AD74B0
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: ClientColorMessagePixelRectReleaseSendWindow
                                                          • String ID:
                                                          • API String ID: 272304278-0
                                                          • Opcode ID: b38f9855ba293a30a5336b2b6d546b377c80f7fefec4a9ef9b4d7cffc8320c97
                                                          • Instruction ID: c057263c196369b13403357d72787c84363ecad1ca5dcfe7d57b0f11d230bd01
                                                          • Opcode Fuzzy Hash: b38f9855ba293a30a5336b2b6d546b377c80f7fefec4a9ef9b4d7cffc8320c97
                                                          • Instruction Fuzzy Hash: 3D015231440215EFEB525FA4DC09BEA7FB6FB04321FA080A4F916A31A0CF311E51AB10
                                                          Function 00AE1874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00AE187F
                                                          • UnloadUserProfile.USERENV(?,?), ref: 00AE188B
                                                          • CloseHandle.KERNEL32(?), ref: 00AE1894
                                                          • CloseHandle.KERNEL32(?), ref: 00AE189C
                                                          • GetProcessHeap.KERNEL32(00000000,?), ref: 00AE18A5
                                                          • HeapFree.KERNEL32(00000000), ref: 00AE18AC
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
                                                          • String ID:
                                                          • API String ID: 146765662-0
                                                          • Opcode ID: b4f788314fb77d54bc259720de87107d5748ad6600741d9f32dac8c3703c5ca4
                                                          • Instruction ID: 4be6d73b956bb1e9806e65697dddec0260e8a4c621bf1fd74b49d0d4793515ed
                                                          • Opcode Fuzzy Hash: b4f788314fb77d54bc259720de87107d5748ad6600741d9f32dac8c3703c5ca4
                                                          • Instruction Fuzzy Hash: F3E0E536484211BBDB015FA1ED0C98ABF3AFF49B22B90C220F225920B0CF729430DF50
                                                          Function 00AEC5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00A87620: _wcslen.LIBCMT ref: 00A87625
                                                          • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00AEC6EE
                                                          • _wcslen.LIBCMT ref: 00AEC735
                                                          • SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00AEC79C
                                                          • SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00AEC7CA
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: ItemMenu$Info_wcslen$Default
                                                          • String ID: 0
                                                          • API String ID: 1227352736-4108050209
                                                          • Opcode ID: 80dca43d494263e4d75f397a3d7d84184777a87e3286de9d99864bf1f3cab5e7
                                                          • Instruction ID: 660a953d7a0b320aadf56da785d76a41a008da4b58761126d6bbbcaa5a8bcb66
                                                          • Opcode Fuzzy Hash: 80dca43d494263e4d75f397a3d7d84184777a87e3286de9d99864bf1f3cab5e7
                                                          • Instruction Fuzzy Hash: C851D5716043809BD715EF2AC985B6BBBE8AF49324F040A2DF995D31E0DB70DD46CB52
                                                          Function 00B0AD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • ShellExecuteExW.SHELL32(0000003C), ref: 00B0AEA3
                                                            • Part of subcall function 00A87620: _wcslen.LIBCMT ref: 00A87625
                                                          • GetProcessId.KERNEL32(00000000), ref: 00B0AF38
                                                          • CloseHandle.KERNEL32(00000000), ref: 00B0AF67
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: CloseExecuteHandleProcessShell_wcslen
                                                          • String ID: <$@
                                                          • API String ID: 146682121-1426351568
                                                          • Opcode ID: 125e05754528d6fcf7adc50c8c174afc1df8b0c7d4696e5a31d95004240bc361
                                                          • Instruction ID: 56afc1410e5147de94487d5ee8ef4c2c17128ad85e3371ce3c7c858a4f086e82
                                                          • Opcode Fuzzy Hash: 125e05754528d6fcf7adc50c8c174afc1df8b0c7d4696e5a31d95004240bc361
                                                          • Instruction Fuzzy Hash: EC715971A00615DFCB14EF54C584A9EBBF0FF08314F1488A9E856AB7A2CB74ED45CBA1
                                                          Function 00AE719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00AE7206
                                                          • SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00AE723C
                                                          • GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00AE724D
                                                          • SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00AE72CF
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: ErrorMode$AddressCreateInstanceProc
                                                          • String ID: DllGetClassObject
                                                          • API String ID: 753597075-1075368562
                                                          • Opcode ID: 9ec3080c5e5b77d83bb63d750cd83e654426c3683c04b362721175ac20281e82
                                                          • Instruction ID: c3922e3cb985681aad3096665498e6778f6c3ab11f6f9bdc5fbf80c3b67838e8
                                                          • Opcode Fuzzy Hash: 9ec3080c5e5b77d83bb63d750cd83e654426c3683c04b362721175ac20281e82
                                                          • Instruction Fuzzy Hash: 46416D71A04245EFDB15CF55C884AEE7BB9EF45310F2480A9BE099F24AD7B1DE44CBA0
                                                          Function 00B13D7C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00B13E35
                                                          • IsMenu.USER32(?), ref: 00B13E4A
                                                          • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00B13E92
                                                          • DrawMenuBar.USER32 ref: 00B13EA5
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Menu$Item$DrawInfoInsert
                                                          • String ID: 0
                                                          • API String ID: 3076010158-4108050209
                                                          • Opcode ID: 61c9628eb7d476b52fbd754df7a1a3f5c9689485a9de5c05ff097c97d8a0fc2c
                                                          • Instruction ID: 3d8acdc41e2394227b1372015beef4b777dc578685be406fa8b57af6e3a2fbd7
                                                          • Opcode Fuzzy Hash: 61c9628eb7d476b52fbd754df7a1a3f5c9689485a9de5c05ff097c97d8a0fc2c
                                                          • Instruction Fuzzy Hash: 13414A76A00309EFDB10DF54D884AEABBF9FF49750F4441A9E905A7290E730AE85CF60
                                                          Function 00AE1DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00A89CB3: _wcslen.LIBCMT ref: 00A89CBD
                                                            • Part of subcall function 00AE3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00AE3CCA
                                                          • SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00AE1E66
                                                          • SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00AE1E79
                                                          • SendMessageW.USER32(?,00000189,?,00000000), ref: 00AE1EA9
                                                            • Part of subcall function 00A86B57: _wcslen.LIBCMT ref: 00A86B6A
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$_wcslen$ClassName
                                                          • String ID: ComboBox$ListBox
                                                          • API String ID: 2081771294-1403004172
                                                          • Opcode ID: 3a9de5e3656bbe52bf3c3a41da3217f3d5bae648db8b8741f9fcb140e3cd2b15
                                                          • Instruction ID: ddf55f4979181445febf193b3d9ba4a558a62e0427d5071bab85bddea01ddba0
                                                          • Opcode Fuzzy Hash: 3a9de5e3656bbe52bf3c3a41da3217f3d5bae648db8b8741f9fcb140e3cd2b15
                                                          • Instruction Fuzzy Hash: 76217871A40144BFDB14ABB6CD4ACFFBBB8EF41350B144519F821A31E1DB384E0A8720
                                                          Function 00B0C9EA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: _wcslen
                                                          • String ID: HKEY_LOCAL_MACHINE$HKLM
                                                          • API String ID: 176396367-4004644295
                                                          • Opcode ID: bf6f51837b1ff7e3761d4d13aa3d1e32aab95ceea163c38b243305c82c85ca19
                                                          • Instruction ID: 7ae5777d5208230e6749e9898bb4aa061b97bdc466cb0d0ab4c6995139a4066a
                                                          • Opcode Fuzzy Hash: bf6f51837b1ff7e3761d4d13aa3d1e32aab95ceea163c38b243305c82c85ca19
                                                          • Instruction Fuzzy Hash: 2931F733B0016A4BCB20DF6C89501BF3FD1DBA1790B1542A9E8556B2DDEB70CE44D3A0
                                                          Function 00B12F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00B12F8D
                                                          • LoadLibraryW.KERNEL32(?), ref: 00B12F94
                                                          • SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00B12FA9
                                                          • DestroyWindow.USER32(?), ref: 00B12FB1
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$DestroyLibraryLoadWindow
                                                          • String ID: SysAnimate32
                                                          • API String ID: 3529120543-1011021900
                                                          • Opcode ID: f72ecb5bb3c94583cc91ce673ab36cef24a78f71b15a41fea925d61aa8ffe2a7
                                                          • Instruction ID: a62f8c2378ad97cc13f2f64dee9748f72c69ca538c8d0d82ec1b363fe06f2523
                                                          • Opcode Fuzzy Hash: f72ecb5bb3c94583cc91ce673ab36cef24a78f71b15a41fea925d61aa8ffe2a7
                                                          • Instruction Fuzzy Hash: 46216A71204209ABEB104F64DC84EFB77F9EB59364F904658FA50D71A0D771DCA29760
                                                          Function 00AA4D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00AA4D1E,00AB28E9,?,00AA4CBE,00AB28E9,00B488B8,0000000C,00AA4E15,00AB28E9,00000002), ref: 00AA4D8D
                                                          • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00AA4DA0
                                                          • FreeLibrary.KERNEL32(00000000,?,?,?,00AA4D1E,00AB28E9,?,00AA4CBE,00AB28E9,00B488B8,0000000C,00AA4E15,00AB28E9,00000002,00000000), ref: 00AA4DC3
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: AddressFreeHandleLibraryModuleProc
                                                          • String ID: CorExitProcess$mscoree.dll
                                                          • API String ID: 4061214504-1276376045
                                                          • Opcode ID: fc197995f3da20a1f803a7987253a4c56e285cfcc2e2fcab4076fb21c4b68aa7
                                                          • Instruction ID: ae363e3fd7d1776cc4225d9d09a9a4993c8a094c497185fad772ec176909b36b
                                                          • Opcode Fuzzy Hash: fc197995f3da20a1f803a7987253a4c56e285cfcc2e2fcab4076fb21c4b68aa7
                                                          • Instruction Fuzzy Hash: 70F03C35A80218BBDB119F94DC49BEEBFA5EF49751F4040A4B809A32A0CF719E50CB90
                                                          Function 00ADD3A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • LoadLibraryA.KERNEL32 ref: 00ADD3AD
                                                          • GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00ADD3BF
                                                          • FreeLibrary.KERNEL32(00000000), ref: 00ADD3E5
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Library$AddressFreeLoadProc
                                                          • String ID: GetSystemWow64DirectoryW$X64
                                                          • API String ID: 145871493-2590602151
                                                          • Opcode ID: 1d3aeaf93421fbfebbf30a953d8abcb8fdc008619497b41d4c4a9b2ca64c658f
                                                          • Instruction ID: 00ac5bcf8a6b975e3fa6ad3c1578dd68f903f9adb1895c06e5ea1ad3f4063d93
                                                          • Opcode Fuzzy Hash: 1d3aeaf93421fbfebbf30a953d8abcb8fdc008619497b41d4c4a9b2ca64c658f
                                                          • Instruction Fuzzy Hash: DCF055314C5A20ABD73017148C18EED7B70AF00702BA4C087F807FA318DF30CE808682
                                                          Function 00A84E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • LoadLibraryA.KERNEL32(kernel32.dll,?,?,00A84EDD,?,00B51418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00A84E9C
                                                          • GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00A84EAE
                                                          • FreeLibrary.KERNEL32(00000000,?,?,00A84EDD,?,00B51418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00A84EC0
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Library$AddressFreeLoadProc
                                                          • String ID: Wow64DisableWow64FsRedirection$kernel32.dll
                                                          • API String ID: 145871493-3689287502
                                                          • Opcode ID: 1a367b8077c281265af25e17abe02863e92dcfe061aec8b9d04cb172ab391529
                                                          • Instruction ID: 03b7434c5cdd4181407a344d5b23d4ce28abeddab8d04186398b51f886fe1501
                                                          • Opcode Fuzzy Hash: 1a367b8077c281265af25e17abe02863e92dcfe061aec8b9d04cb172ab391529
                                                          • Instruction Fuzzy Hash: 92E0CD35A855236BD3312B256C18BDF6A94AF85F627454115FC04F3114DF64CD0141A0
                                                          Function 00A84E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • LoadLibraryA.KERNEL32(kernel32.dll,?,?,00AC3CDE,?,00B51418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00A84E62
                                                          • GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00A84E74
                                                          • FreeLibrary.KERNEL32(00000000,?,?,00AC3CDE,?,00B51418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00A84E87
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Library$AddressFreeLoadProc
                                                          • String ID: Wow64RevertWow64FsRedirection$kernel32.dll
                                                          • API String ID: 145871493-1355242751
                                                          • Opcode ID: 1ef6c721cced8e3ec2ee4b20b2c810f8ec374ab6d6e020bf6cc5bc539804f888
                                                          • Instruction ID: 3b20489445cc3f30b94d434c12b42f6d28f98ba7531ff156146d258488b92e85
                                                          • Opcode Fuzzy Hash: 1ef6c721cced8e3ec2ee4b20b2c810f8ec374ab6d6e020bf6cc5bc539804f888
                                                          • Instruction Fuzzy Hash: 1BD012355826226756222B256C18ECB6E58AF89F513454565F905F3124CF60CE2186D0
                                                          Function 00AF2947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00AF2C05
                                                          • DeleteFileW.KERNEL32(?), ref: 00AF2C87
                                                          • CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00AF2C9D
                                                          • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00AF2CAE
                                                          • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00AF2CC0
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: File$Delete$Copy
                                                          • String ID:
                                                          • API String ID: 3226157194-0
                                                          • Opcode ID: 28ee241a167218895055f9f533db8b56fea35b276748cccd3e4505568c40602e
                                                          • Instruction ID: 777463fde0cdc58254c19feea553f5b1f66282cbc349eba5df0bec708d5f58fb
                                                          • Opcode Fuzzy Hash: 28ee241a167218895055f9f533db8b56fea35b276748cccd3e4505568c40602e
                                                          • Instruction Fuzzy Hash: 03B11C71D0011DABDF11EBE4CD85EEEBBBDEF49350F1040A6FA09A7191EB309A448B61
                                                          Function 00B0A387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetCurrentProcessId.KERNEL32 ref: 00B0A427
                                                          • OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00B0A435
                                                          • GetProcessIoCounters.KERNEL32(00000000,?), ref: 00B0A468
                                                          • CloseHandle.KERNEL32(?), ref: 00B0A63D
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Process$CloseCountersCurrentHandleOpen
                                                          • String ID:
                                                          • API String ID: 3488606520-0
                                                          • Opcode ID: e41cd924810e932e462354c39ce61b9144555b9f187cb9526d9aefc5b92dd6fb
                                                          • Instruction ID: 6740545734124a24a559615ceb5a9feff304adcd197dfbc20c04f007c715b5b4
                                                          • Opcode Fuzzy Hash: e41cd924810e932e462354c39ce61b9144555b9f187cb9526d9aefc5b92dd6fb
                                                          • Instruction Fuzzy Hash: C4A19071604300AFE720EF24D986F2ABBE5AF84714F14885DF55A9B3D2DB71EC418B92
                                                          Function 00AEE3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00AEDDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00AECF22,?), ref: 00AEDDFD
                                                            • Part of subcall function 00AEDDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00AECF22,?), ref: 00AEDE16
                                                            • Part of subcall function 00AEE199: GetFileAttributesW.KERNEL32(?,00AECF95), ref: 00AEE19A
                                                          • lstrcmpiW.KERNEL32(?,?), ref: 00AEE473
                                                          • MoveFileW.KERNEL32(?,?), ref: 00AEE4AC
                                                          • _wcslen.LIBCMT ref: 00AEE5EB
                                                          • _wcslen.LIBCMT ref: 00AEE603
                                                          • SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 00AEE650
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
                                                          • String ID:
                                                          • API String ID: 3183298772-0
                                                          • Opcode ID: 7981b746887fc97c421dd940dd5d0c72fb31a6563c3b62fafa66ff6b69ed98f8
                                                          • Instruction ID: de06c2eb19446bfea6a7a9181b1722f4a6bd2ddcc23ef07ad9ea2a6257e9e7fa
                                                          • Opcode Fuzzy Hash: 7981b746887fc97c421dd940dd5d0c72fb31a6563c3b62fafa66ff6b69ed98f8
                                                          • Instruction Fuzzy Hash: 9F5184B24083859BC724EBA5DD819EFB3ECAF85340F00491EF589D3191EF75A68C8766
                                                          Function 00B0B9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00A89CB3: _wcslen.LIBCMT ref: 00A89CBD
                                                            • Part of subcall function 00B0C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00B0B6AE,?,?), ref: 00B0C9B5
                                                            • Part of subcall function 00B0C998: _wcslen.LIBCMT ref: 00B0C9F1
                                                            • Part of subcall function 00B0C998: _wcslen.LIBCMT ref: 00B0CA68
                                                            • Part of subcall function 00B0C998: _wcslen.LIBCMT ref: 00B0CA9E
                                                          • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00B0BAA5
                                                          • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00B0BB00
                                                          • RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00B0BB63
                                                          • RegCloseKey.ADVAPI32(?,?), ref: 00B0BBA6
                                                          • RegCloseKey.ADVAPI32(00000000), ref: 00B0BBB3
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
                                                          • String ID:
                                                          • API String ID: 826366716-0
                                                          • Opcode ID: 57dc7a22487f33c6967ea564a76f57acde8d283ca3b660a4f81a4e58086a23ff
                                                          • Instruction ID: 93e404fe81816cd3c5a98c9758be9507c0c2a2a515c94e3ac7f241104bc384d0
                                                          • Opcode Fuzzy Hash: 57dc7a22487f33c6967ea564a76f57acde8d283ca3b660a4f81a4e58086a23ff
                                                          • Instruction Fuzzy Hash: 4961AF31208241EFD714DF24C494E2ABBE5FF84308F54899DF49A8B2A2DB31ED45CB92
                                                          Function 00AE8BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • VariantInit.OLEAUT32(?), ref: 00AE8BCD
                                                          • VariantClear.OLEAUT32 ref: 00AE8C3E
                                                          • VariantClear.OLEAUT32 ref: 00AE8C9D
                                                          • VariantClear.OLEAUT32(?), ref: 00AE8D10
                                                          • VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00AE8D3B
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Variant$Clear$ChangeInitType
                                                          • String ID:
                                                          • API String ID: 4136290138-0
                                                          • Opcode ID: ea9952aa76042f6bb8bf0c24e7f720ac5bbdeae056f448a7159cecdc353fe54a
                                                          • Instruction ID: 2a62e9bb59bad4a7a9b58f7c504b4cb91ef708d4312242c51507de3f9a22b46c
                                                          • Opcode Fuzzy Hash: ea9952aa76042f6bb8bf0c24e7f720ac5bbdeae056f448a7159cecdc353fe54a
                                                          • Instruction Fuzzy Hash: 26518CB5A00219EFCB10CF59C894AAAB7F5FF89310B118559F909DB350E734E911CF90
                                                          Function 00AF8AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00AF8BAE
                                                          • GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00AF8BDA
                                                          • WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00AF8C32
                                                          • WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00AF8C57
                                                          • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00AF8C5F
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: PrivateProfile$SectionWrite$String
                                                          • String ID:
                                                          • API String ID: 2832842796-0
                                                          • Opcode ID: 3c8be385c11a789a31ca20a7e2c69a17c5edfcebb06657975ac36427046783b2
                                                          • Instruction ID: 85b0b36b29dbc306cdd12570d54f391fd2b8a8f47cad396897cb45ecd2d8a32e
                                                          • Opcode Fuzzy Hash: 3c8be385c11a789a31ca20a7e2c69a17c5edfcebb06657975ac36427046783b2
                                                          • Instruction Fuzzy Hash: 8A514C35A002199FCB05EF64C981E6DBBF5FF49314F088458E94AAB362DB35ED51CBA0
                                                          Function 00B08EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • LoadLibraryW.KERNEL32(?,00000000,?), ref: 00B08F40
                                                          • GetProcAddress.KERNEL32(00000000,?), ref: 00B08FD0
                                                          • GetProcAddress.KERNEL32(00000000,00000000), ref: 00B08FEC
                                                          • GetProcAddress.KERNEL32(00000000,?), ref: 00B09032
                                                          • FreeLibrary.KERNEL32(00000000), ref: 00B09052
                                                            • Part of subcall function 00A9F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00AF1043,?,753CE610), ref: 00A9F6E6
                                                            • Part of subcall function 00A9F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00ADFA64,00000000,00000000,?,?,00AF1043,?,753CE610,?,00ADFA64), ref: 00A9F70D
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
                                                          • String ID:
                                                          • API String ID: 666041331-0
                                                          • Opcode ID: a8ea8fbb1f1de1e226b2c96c3288f3f4a8cc030eede75cc9dd71c5bace279d27
                                                          • Instruction ID: 462e5ac9dc48093d5ad9e7cd186fefb6bfc01131696cfe2d3ae22e2a6997c01f
                                                          • Opcode Fuzzy Hash: a8ea8fbb1f1de1e226b2c96c3288f3f4a8cc030eede75cc9dd71c5bace279d27
                                                          • Instruction Fuzzy Hash: 30513E35604205DFC715EF64C5948ADBFF1FF49314B0880A9E84AAB3A2DB31EE85CB91
                                                          Function 00B16B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SetWindowLongW.USER32(00000002,000000F0,?), ref: 00B16C33
                                                          • SetWindowLongW.USER32(?,000000EC,?), ref: 00B16C4A
                                                          • SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00B16C73
                                                          • ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,00AFAB79,00000000,00000000), ref: 00B16C98
                                                          • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00B16CC7
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Window$Long$MessageSendShow
                                                          • String ID:
                                                          • API String ID: 3688381893-0
                                                          • Opcode ID: 733e076b760cbf200ced192820f32e513d17b1f33f62c3a4fc2a4e9753298a09
                                                          • Instruction ID: e32fdaecfa1e3d0a2c549cc5c7590e1504b196778a0ff515192a2c72dafa1d9b
                                                          • Opcode Fuzzy Hash: 733e076b760cbf200ced192820f32e513d17b1f33f62c3a4fc2a4e9753298a09
                                                          • Instruction Fuzzy Hash: E241D435A04104AFD724CF28CC99FEA7FE5EB09350F9542A8F895A72E0D771AD81CA80
                                                          Function 00AB2051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: _free
                                                          • String ID:
                                                          • API String ID: 269201875-0
                                                          • Opcode ID: 27eeac6136b17cc5f5c70c5f5d6cf43338e8c4f4cf0653c2be2b446e535ebb9a
                                                          • Instruction ID: 0e0716294fe24a09a67ce261fa2431c79917d66b3a784acd8ae7a07252fd72d9
                                                          • Opcode Fuzzy Hash: 27eeac6136b17cc5f5c70c5f5d6cf43338e8c4f4cf0653c2be2b446e535ebb9a
                                                          • Instruction Fuzzy Hash: A941D372A00200AFCB24DF78C981B9DB7F9EF89714F15456AE515EB396DB31AD01CB80
                                                          Function 00A9912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetCursorPos.USER32(?), ref: 00A99141
                                                          • ScreenToClient.USER32(00000000,?), ref: 00A9915E
                                                          • GetAsyncKeyState.USER32(00000001), ref: 00A99183
                                                          • GetAsyncKeyState.USER32(00000002), ref: 00A9919D
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: AsyncState$ClientCursorScreen
                                                          • String ID:
                                                          • API String ID: 4210589936-0
                                                          • Opcode ID: e237c95fe0b4c058997f1355cf9a760d3a666157be8a9d14a60a06210216e2f8
                                                          • Instruction ID: 4836c946d6df03d26a5bb94cf34bf39c8524d3f578cda88aa508efb0cfaf3499
                                                          • Opcode Fuzzy Hash: e237c95fe0b4c058997f1355cf9a760d3a666157be8a9d14a60a06210216e2f8
                                                          • Instruction Fuzzy Hash: 90414F71A0851AFBDF199F68C844BEEB7B5FB05320F20831AF429A72E0D7305990CB91
                                                          Function 00AF3874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetInputState.USER32 ref: 00AF38CB
                                                          • TranslateAcceleratorW.USER32(?,00000000,?), ref: 00AF3922
                                                          • TranslateMessage.USER32(?), ref: 00AF394B
                                                          • DispatchMessageW.USER32(?), ref: 00AF3955
                                                          • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00AF3966
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Message$Translate$AcceleratorDispatchInputPeekState
                                                          • String ID:
                                                          • API String ID: 2256411358-0
                                                          • Opcode ID: 89e302939c1342fa42bd672d286b904e558a0850f5a21c0ec907b47bfd5c07cb
                                                          • Instruction ID: cb9eb31274cbb6fef1c34ba3b7246e09af8607833cc6378fe40ae862fd2fa509
                                                          • Opcode Fuzzy Hash: 89e302939c1342fa42bd672d286b904e558a0850f5a21c0ec907b47bfd5c07cb
                                                          • Instruction Fuzzy Hash: 71311E7250434A9EEF35CBB4D8A8BB63BE8DB15341F04459DF662C3190E7F49A85CB11
                                                          Function 00AFCF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,00000000,?,?,?,00AFC21E,00000000), ref: 00AFCF38
                                                          • InternetReadFile.WININET(?,00000000,?,?), ref: 00AFCF6F
                                                          • GetLastError.KERNEL32(?,00000000,?,?,?,00AFC21E,00000000), ref: 00AFCFB4
                                                          • SetEvent.KERNEL32(?,?,00000000,?,?,?,00AFC21E,00000000), ref: 00AFCFC8
                                                          • SetEvent.KERNEL32(?,?,00000000,?,?,?,00AFC21E,00000000), ref: 00AFCFF2
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: EventInternet$AvailableDataErrorFileLastQueryRead
                                                          • String ID:
                                                          • API String ID: 3191363074-0
                                                          • Opcode ID: cdf0d77c2a681c1a42108ee3a9cc5022bbf9aa4ba7a1aca7bf807cbc610a2ebc
                                                          • Instruction ID: 5b709dfc957fbc4d7c34ab07e0da4f5fbbe16cb2c1fdc879a9204121187b1e71
                                                          • Opcode Fuzzy Hash: cdf0d77c2a681c1a42108ee3a9cc5022bbf9aa4ba7a1aca7bf807cbc610a2ebc
                                                          • Instruction Fuzzy Hash: 54314F7160430DAFDB20DFE6CA849BABBF9EB14364B10842EF616D3141DB30AE40DB60
                                                          Function 00AE1901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetWindowRect.USER32(?,?), ref: 00AE1915
                                                          • PostMessageW.USER32(00000001,00000201,00000001), ref: 00AE19C1
                                                          • Sleep.KERNEL32(00000000,?,?,?), ref: 00AE19C9
                                                          • PostMessageW.USER32(00000001,00000202,00000000), ref: 00AE19DA
                                                          • Sleep.KERNEL32(00000000,?,?,?,?), ref: 00AE19E2
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: MessagePostSleep$RectWindow
                                                          • String ID:
                                                          • API String ID: 3382505437-0
                                                          • Opcode ID: 3971b212f5ec276a9e7a16d2f2a676acc1f8fa73716be0172895381254c3082b
                                                          • Instruction ID: d789a68f0eed2b5f351014072024aef0e1938ef186b1bbfa7281cec5964bfa68
                                                          • Opcode Fuzzy Hash: 3971b212f5ec276a9e7a16d2f2a676acc1f8fa73716be0172895381254c3082b
                                                          • Instruction Fuzzy Hash: 9C31B471A00269EFCB04CFA9CD99ADE7BB5EB44315F108225F921A72D1C7709D54CB90
                                                          Function 00B15706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SendMessageW.USER32(?,00001053,000000FF,?), ref: 00B15745
                                                          • SendMessageW.USER32(?,00001074,?,00000001), ref: 00B1579D
                                                          • _wcslen.LIBCMT ref: 00B157AF
                                                          • _wcslen.LIBCMT ref: 00B157BA
                                                          • SendMessageW.USER32(?,00001002,00000000,?), ref: 00B15816
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$_wcslen
                                                          • String ID:
                                                          • API String ID: 763830540-0
                                                          • Opcode ID: f6e49acb1a137e0454f8cf7509379a56cac75674a6f0afce038b436edcf33bce
                                                          • Instruction ID: a97766e1fbfe3f1bad3007c4c7a7bfeb4663ad3fdcf1ba95977bcf69f3b52584
                                                          • Opcode Fuzzy Hash: f6e49acb1a137e0454f8cf7509379a56cac75674a6f0afce038b436edcf33bce
                                                          • Instruction Fuzzy Hash: EE218071904618DADB309F64CC85AEEBBB8EB85324F508296E929AB2C4D77099C5CF50
                                                          Function 00B00930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • IsWindow.USER32(00000000), ref: 00B00951
                                                          • GetForegroundWindow.USER32 ref: 00B00968
                                                          • GetDC.USER32(00000000), ref: 00B009A4
                                                          • GetPixel.GDI32(00000000,?,00000003), ref: 00B009B0
                                                          • ReleaseDC.USER32(00000000,00000003), ref: 00B009E8
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Window$ForegroundPixelRelease
                                                          • String ID:
                                                          • API String ID: 4156661090-0
                                                          • Opcode ID: f07b92292e6324ec8d8498fbea986a9a6684b01e2577853344dede085c937d50
                                                          • Instruction ID: 6e8ea8a6a847f00cabeee0e35aa0d6dcf6991a29e057cc597bd81afae73b44c0
                                                          • Opcode Fuzzy Hash: f07b92292e6324ec8d8498fbea986a9a6684b01e2577853344dede085c937d50
                                                          • Instruction Fuzzy Hash: FF219075600204AFD704EF69D984AAEBBF9EF49700F04806CF94AE73A2CB70AD04CB50
                                                          Function 00ABCDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetEnvironmentStringsW.KERNEL32 ref: 00ABCDC6
                                                          • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00ABCDE9
                                                            • Part of subcall function 00AB3820: RtlAllocateHeap.NTDLL(00000000,?,00B51444,?,00A9FDF5,?,?,00A8A976,00000010,00B51440,00A813FC,?,00A813C6,?,00A81129), ref: 00AB3852
                                                          • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00ABCE0F
                                                          • _free.LIBCMT ref: 00ABCE22
                                                          • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00ABCE31
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
                                                          • String ID:
                                                          • API String ID: 336800556-0
                                                          • Opcode ID: 6014825eea41aeb24d223e3f978a11d6aa36e864b36e6420e48e76078a166447
                                                          • Instruction ID: 3eaa0d68974c7e756c7d314b79a04b5c5f0ff7f80a29480bdac3de7ffa9d2314
                                                          • Opcode Fuzzy Hash: 6014825eea41aeb24d223e3f978a11d6aa36e864b36e6420e48e76078a166447
                                                          • Instruction Fuzzy Hash: 4F018472601215BFA7211BB66C88DFB6E6DEEC6BB13154129F905DB202EE61CD0191B0
                                                          Function 00A99639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00A99693
                                                          • SelectObject.GDI32(?,00000000), ref: 00A996A2
                                                          • BeginPath.GDI32(?), ref: 00A996B9
                                                          • SelectObject.GDI32(?,00000000), ref: 00A996E2
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: ObjectSelect$BeginCreatePath
                                                          • String ID:
                                                          • API String ID: 3225163088-0
                                                          • Opcode ID: ac18532dc8eb660fdbf408b971bf60ff1929c6c276c7a5db71d9cf67f5f88f04
                                                          • Instruction ID: 59adc968cde40dea268567ddd64219d2c079fabb4b2bc9ceafe1156b6de5d7a4
                                                          • Opcode Fuzzy Hash: ac18532dc8eb660fdbf408b971bf60ff1929c6c276c7a5db71d9cf67f5f88f04
                                                          • Instruction Fuzzy Hash: 4F217F70902305FBDF119F6CEC087EA3BB9BB11356F50465AF511A71A0DBB05892CBA4
                                                          Function 00AE5711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: _memcmp
                                                          • String ID:
                                                          • API String ID: 2931989736-0
                                                          • Opcode ID: 377e10da8d06425eafaeddf0fa78b9be2ce0be3a80790b6c427b05b3fb55d81e
                                                          • Instruction ID: a11453c039b6fbb4b989f382362dada0e7f7fd78b213e447bcc2e93a89c2377d
                                                          • Opcode Fuzzy Hash: 377e10da8d06425eafaeddf0fa78b9be2ce0be3a80790b6c427b05b3fb55d81e
                                                          • Instruction Fuzzy Hash: 88019671A45645FA96089622AE52FFB739CDB21398F404420FD04AF281F761ED60C2F0
                                                          Function 00A9990C Relevance: 7.6, APIs: 5, Instructions: 61COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetSysColor.USER32(00000008), ref: 00A998CC
                                                          • SetTextColor.GDI32(?,?), ref: 00A998D6
                                                          • SetBkMode.GDI32(?,00000001), ref: 00A998E9
                                                          • GetStockObject.GDI32(00000005), ref: 00A998F1
                                                          • GetWindowLongW.USER32(?,000000EB), ref: 00A99952
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Color$LongModeObjectStockTextWindow
                                                          • String ID:
                                                          • API String ID: 1860813098-0
                                                          • Opcode ID: 6358800a50537e99923de9cfcb0af1dfaf62842f354182060d461b4106a7d4ea
                                                          • Instruction ID: 11c7452de585697ac1dca59cbe677ca6e47f5e589b730769b18a0f3ec656a5cf
                                                          • Opcode Fuzzy Hash: 6358800a50537e99923de9cfcb0af1dfaf62842f354182060d461b4106a7d4ea
                                                          • Instruction Fuzzy Hash: 79110632286250BFCF224F69EC59AEA3FA4EB13321B08815DF5929B1B1DA310851CB51
                                                          Function 00AB2DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          • GetLastError.KERNEL32(?,?,?,00AAF2DE,00AB3863,00B51444,?,00A9FDF5,?,?,00A8A976,00000010,00B51440,00A813FC,?,00A813C6), ref: 00AB2DFD
                                                          • _free.LIBCMT ref: 00AB2E32
                                                          • _free.LIBCMT ref: 00AB2E59
                                                          • SetLastError.KERNEL32(00000000,00A81129), ref: 00AB2E66
                                                          • SetLastError.KERNEL32(00000000,00A81129), ref: 00AB2E6F
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: ErrorLast$_free
                                                          • String ID:
                                                          • API String ID: 3170660625-0
                                                          • Opcode ID: c4732cd7da352ac5b607d2688ca525d79bfb0bf673a9fad03ea068f7bf9a8e0d
                                                          • Instruction ID: 35894d302398b84493de645329ef39f3fd855a18afdc696d5bf4970ff4919902
                                                          • Opcode Fuzzy Hash: c4732cd7da352ac5b607d2688ca525d79bfb0bf673a9fad03ea068f7bf9a8e0d
                                                          • Instruction Fuzzy Hash: 3F01F4362456006BCA1327366D45FEB2E7DBBD67A1B24442AF825A31D3EE34CC014320
                                                          Function 00AE000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00ADFF41,80070057,?,?,?,00AE035E), ref: 00AE002B
                                                          • ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00ADFF41,80070057,?,?), ref: 00AE0046
                                                          • lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00ADFF41,80070057,?,?), ref: 00AE0054
                                                          • CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00ADFF41,80070057,?), ref: 00AE0064
                                                          • CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00ADFF41,80070057,?,?), ref: 00AE0070
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: From$Prog$FreeStringTasklstrcmpi
                                                          • String ID:
                                                          • API String ID: 3897988419-0
                                                          • Opcode ID: 0d11e1540472c3dd245ccb32b05ac71a8fbee63e164217a040798684927339b7
                                                          • Instruction ID: f20db1bef8667e29c516852707c903b8e5389cbb580180434945a47bf55ecc38
                                                          • Opcode Fuzzy Hash: 0d11e1540472c3dd245ccb32b05ac71a8fbee63e164217a040798684927339b7
                                                          • Instruction Fuzzy Hash: 6C018B72640204BFDB109F6AEC44FAA7EADEB44792F148124F905D3210EBB1DD808BA0
                                                          Function 00AEE97B Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • QueryPerformanceCounter.KERNEL32(?), ref: 00AEE997
                                                          • QueryPerformanceFrequency.KERNEL32(?), ref: 00AEE9A5
                                                          • Sleep.KERNEL32(00000000), ref: 00AEE9AD
                                                          • QueryPerformanceCounter.KERNEL32(?), ref: 00AEE9B7
                                                          • Sleep.KERNEL32 ref: 00AEE9F3
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: PerformanceQuery$CounterSleep$Frequency
                                                          • String ID:
                                                          • API String ID: 2833360925-0
                                                          • Opcode ID: c6bb8ba3378e481de85ac1c9ac6fb43325b1935ed0103866f977cf493c5576e4
                                                          • Instruction ID: 9978ca1550389634ed1fad4e8d9a2865eb5022575d19cfd641aa41f5d464bff0
                                                          • Opcode Fuzzy Hash: c6bb8ba3378e481de85ac1c9ac6fb43325b1935ed0103866f977cf493c5576e4
                                                          • Instruction Fuzzy Hash: 8B015731C41629EBCF00EBE6DC49AEDFBB8FB08700F404546E502B2242CF309660CBA1
                                                          Function 00AE10F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00AE1114
                                                          • GetLastError.KERNEL32(?,00000000,00000000,?,?,00AE0B9B,?,?,?), ref: 00AE1120
                                                          • GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00AE0B9B,?,?,?), ref: 00AE112F
                                                          • HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00AE0B9B,?,?,?), ref: 00AE1136
                                                          • GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00AE114D
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: HeapObjectSecurityUser$AllocErrorLastProcess
                                                          • String ID:
                                                          • API String ID: 842720411-0
                                                          • Opcode ID: 3147ee3ac9c5c2bd7422c81bc6e132186575f61bd5756130fcd68f37b67b3ff5
                                                          • Instruction ID: 2bbc37d7a0953b9ec9a16f757ebf9183139287088e0b232f8f45a324179e90bd
                                                          • Opcode Fuzzy Hash: 3147ee3ac9c5c2bd7422c81bc6e132186575f61bd5756130fcd68f37b67b3ff5
                                                          • Instruction Fuzzy Hash: 88018C79240315BFDB125FA5DC49EAA3F6EEF8A3A4B608418FA41D3360DF71DC108A60
                                                          Function 00AE0FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00AE0FCA
                                                          • GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00AE0FD6
                                                          • GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00AE0FE5
                                                          • HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00AE0FEC
                                                          • GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00AE1002
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: HeapInformationToken$AllocErrorLastProcess
                                                          • String ID:
                                                          • API String ID: 44706859-0
                                                          • Opcode ID: b64adef362e4bab5f3eaab3a91ced02045238b115df6a276cce20604c8ea956a
                                                          • Instruction ID: 0599f8858e6bd5347f3068577427488947c367306394a18f483f199cae4ca098
                                                          • Opcode Fuzzy Hash: b64adef362e4bab5f3eaab3a91ced02045238b115df6a276cce20604c8ea956a
                                                          • Instruction Fuzzy Hash: D6F04F39180351BBD7214FA59C4DF963F6EEF89761F518414FA46D7291CE70DC508A60
                                                          Function 00AE1014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00AE102A
                                                          • GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00AE1036
                                                          • GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00AE1045
                                                          • HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00AE104C
                                                          • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00AE1062
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: HeapInformationToken$AllocErrorLastProcess
                                                          • String ID:
                                                          • API String ID: 44706859-0
                                                          • Opcode ID: 4aeb1997a1a636d2aff7b484af1c9da893cedb78fa7d61cc77091d96370af5f9
                                                          • Instruction ID: 564541ce1ac2ac51411ab834aa1f08228160ff6cabc7d4de2e99bc39917d3ad9
                                                          • Opcode Fuzzy Hash: 4aeb1997a1a636d2aff7b484af1c9da893cedb78fa7d61cc77091d96370af5f9
                                                          • Instruction Fuzzy Hash: 74F0CD39280311FBDB211FA5EC4CF963FAEEF89761FA14424FA05D7250CE30D8408A60
                                                          Function 00AF030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CloseHandle.KERNEL32(?,?,?,?,00AF017D,?,00AF32FC,?,00000001,00AC2592,?), ref: 00AF0324
                                                          • CloseHandle.KERNEL32(?,?,?,?,00AF017D,?,00AF32FC,?,00000001,00AC2592,?), ref: 00AF0331
                                                          • CloseHandle.KERNEL32(?,?,?,?,00AF017D,?,00AF32FC,?,00000001,00AC2592,?), ref: 00AF033E
                                                          • CloseHandle.KERNEL32(?,?,?,?,00AF017D,?,00AF32FC,?,00000001,00AC2592,?), ref: 00AF034B
                                                          • CloseHandle.KERNEL32(?,?,?,?,00AF017D,?,00AF32FC,?,00000001,00AC2592,?), ref: 00AF0358
                                                          • CloseHandle.KERNEL32(?,?,?,?,00AF017D,?,00AF32FC,?,00000001,00AC2592,?), ref: 00AF0365
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: CloseHandle
                                                          • String ID:
                                                          • API String ID: 2962429428-0
                                                          • Opcode ID: d9593229e84e15a2f6edf8c374911def4f3f5a89c2381d8640e0f97a7bda893b
                                                          • Instruction ID: f3962c675dcbc38231aef31e14269b8b59f208155ebec106a536f0771987399d
                                                          • Opcode Fuzzy Hash: d9593229e84e15a2f6edf8c374911def4f3f5a89c2381d8640e0f97a7bda893b
                                                          • Instruction Fuzzy Hash: 5A01A272800B199FC7309FA6D880822FBF5BF503153158A3FE29652932C771A954CF80
                                                          Function 00ABD73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          • _free.LIBCMT ref: 00ABD752
                                                            • Part of subcall function 00AB29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00ABD7D1,00000000,00000000,00000000,00000000,?,00ABD7F8,00000000,00000007,00000000,?,00ABDBF5,00000000), ref: 00AB29DE
                                                            • Part of subcall function 00AB29C8: GetLastError.KERNEL32(00000000,?,00ABD7D1,00000000,00000000,00000000,00000000,?,00ABD7F8,00000000,00000007,00000000,?,00ABDBF5,00000000,00000000), ref: 00AB29F0
                                                          • _free.LIBCMT ref: 00ABD764
                                                          • _free.LIBCMT ref: 00ABD776
                                                          • _free.LIBCMT ref: 00ABD788
                                                          • _free.LIBCMT ref: 00ABD79A
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: _free$ErrorFreeHeapLast
                                                          • String ID:
                                                          • API String ID: 776569668-0
                                                          • Opcode ID: 18c80108d629e7fe1d5309067675945611ef12208ee26f28c49dbf5c0bbc2e88
                                                          • Instruction ID: 20f656032480a47cf80a2ef982af7c4d2efd118698702652951830a41b47ff0f
                                                          • Opcode Fuzzy Hash: 18c80108d629e7fe1d5309067675945611ef12208ee26f28c49dbf5c0bbc2e88
                                                          • Instruction Fuzzy Hash: 86F0F936545208BB8665EB68FAC6DDA7BDDBB85B10BA40C06F048E7503DF20FC808B64
                                                          Function 00AE5C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetDlgItem.USER32(?,000003E9), ref: 00AE5C58
                                                          • GetWindowTextW.USER32(00000000,?,00000100), ref: 00AE5C6F
                                                          • MessageBeep.USER32(00000000), ref: 00AE5C87
                                                          • KillTimer.USER32(?,0000040A), ref: 00AE5CA3
                                                          • EndDialog.USER32(?,00000001), ref: 00AE5CBD
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: BeepDialogItemKillMessageTextTimerWindow
                                                          • String ID:
                                                          • API String ID: 3741023627-0
                                                          • Opcode ID: 3be428d2854df06d5dda760e51af0f9d5f936e609a7603b1b762336383a5293e
                                                          • Instruction ID: 35eb5401d913a36790158649032d779e4bf98ea1cbba9c16deb413e846fb6748
                                                          • Opcode Fuzzy Hash: 3be428d2854df06d5dda760e51af0f9d5f936e609a7603b1b762336383a5293e
                                                          • Instruction Fuzzy Hash: 1D018630940B44ABEB245B21ED5EFE67BB8BF44B09F505559A583A20E1DBF0A984CB90
                                                          Function 00AB22A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • _free.LIBCMT ref: 00AB22BE
                                                            • Part of subcall function 00AB29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00ABD7D1,00000000,00000000,00000000,00000000,?,00ABD7F8,00000000,00000007,00000000,?,00ABDBF5,00000000), ref: 00AB29DE
                                                            • Part of subcall function 00AB29C8: GetLastError.KERNEL32(00000000,?,00ABD7D1,00000000,00000000,00000000,00000000,?,00ABD7F8,00000000,00000007,00000000,?,00ABDBF5,00000000,00000000), ref: 00AB29F0
                                                          • _free.LIBCMT ref: 00AB22D0
                                                          • _free.LIBCMT ref: 00AB22E3
                                                          • _free.LIBCMT ref: 00AB22F4
                                                          • _free.LIBCMT ref: 00AB2305
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: _free$ErrorFreeHeapLast
                                                          • String ID:
                                                          • API String ID: 776569668-0
                                                          • Opcode ID: 8ff7de0e92afed6589cb73576f91dd91daa362b7576854a7c87f63cb4a56c767
                                                          • Instruction ID: b7c7aaae89790982571653bfa834a917163902f45d34f81bec36f163914356ea
                                                          • Opcode Fuzzy Hash: 8ff7de0e92afed6589cb73576f91dd91daa362b7576854a7c87f63cb4a56c767
                                                          • Instruction Fuzzy Hash: F3F0D075411310AB8652BF58BD01B983F69B76DB52B050E87F418D7272CF310551ABA5
                                                          Function 00A995C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • EndPath.GDI32(?), ref: 00A995D4
                                                          • StrokeAndFillPath.GDI32(?,?,00AD71F7,00000000,?,?,?), ref: 00A995F0
                                                          • SelectObject.GDI32(?,00000000), ref: 00A99603
                                                          • DeleteObject.GDI32 ref: 00A99616
                                                          • StrokePath.GDI32(?), ref: 00A99631
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Path$ObjectStroke$DeleteFillSelect
                                                          • String ID:
                                                          • API String ID: 2625713937-0
                                                          • Opcode ID: de202c6e1d781feaa2e184da267d79593bac477b83590b1b0779b204224063ee
                                                          • Instruction ID: b5e9c7c09017a837f53f73ce343db84a60272f37f7cd810b4bb4348146307445
                                                          • Opcode Fuzzy Hash: de202c6e1d781feaa2e184da267d79593bac477b83590b1b0779b204224063ee
                                                          • Instruction Fuzzy Hash: 91F0F630145304EBDB125F6DED1C7AA3FA1AB05322F448658E565960F1CF3089A6DF64
                                                          Function 00AB0F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: __freea$_free
                                                          • String ID: a/p$am/pm
                                                          • API String ID: 3432400110-3206640213
                                                          • Opcode ID: 7bf1b06f2f6966e2bc6ed0fab9c062e2b45689bd28c5047deb3cca05287d77cf
                                                          • Instruction ID: e4034135509b6f9786048d5b00188adbf8412ca66a444d5ddcace7d1e96a6233
                                                          • Opcode Fuzzy Hash: 7bf1b06f2f6966e2bc6ed0fab9c062e2b45689bd28c5047deb3cca05287d77cf
                                                          • Instruction Fuzzy Hash: A2D1E431900205DADB649F68C865BFEB7F9FF05300FA84269E5019F653E7759D80CB91
                                                          Function 00B07B7E Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 230COMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00AA0242: EnterCriticalSection.KERNEL32(00B5070C,00B51884,?,?,00A9198B,00B52518,?,?,?,00A812F9,00000000), ref: 00AA024D
                                                            • Part of subcall function 00AA0242: LeaveCriticalSection.KERNEL32(00B5070C,?,00A9198B,00B52518,?,?,?,00A812F9,00000000), ref: 00AA028A
                                                            • Part of subcall function 00A89CB3: _wcslen.LIBCMT ref: 00A89CBD
                                                            • Part of subcall function 00AA00A3: __onexit.LIBCMT ref: 00AA00A9
                                                          • __Init_thread_footer.LIBCMT ref: 00B07BFB
                                                            • Part of subcall function 00AA01F8: EnterCriticalSection.KERNEL32(00B5070C,?,?,00A98747,00B52514), ref: 00AA0202
                                                            • Part of subcall function 00AA01F8: LeaveCriticalSection.KERNEL32(00B5070C,?,00A98747,00B52514), ref: 00AA0235
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
                                                          • String ID: 5$G$Variable must be of type 'Object'.
                                                          • API String ID: 535116098-3733170431
                                                          • Opcode ID: db3d57c0307efd016ad9d581974cd5e01f570d105b878e50e58d737fc8e76103
                                                          • Instruction ID: 1bc5020ea696218fdb24db6883e53b68234fb66ecc0808c30185cabd7b6b1ea4
                                                          • Opcode Fuzzy Hash: db3d57c0307efd016ad9d581974cd5e01f570d105b878e50e58d737fc8e76103
                                                          • Instruction Fuzzy Hash: B1919BB0A44209AFDB14EF94D9909AEBBF1FF45300F148199F8069B291DB71AE45CB91
                                                          Function 00AE2716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00AEB403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00AE21D0,?,?,00000034,00000800,?,00000034), ref: 00AEB42D
                                                          • SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00AE2760
                                                            • Part of subcall function 00AEB3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00AE21FF,?,?,00000800,?,00001073,00000000,?,?), ref: 00AEB3F8
                                                            • Part of subcall function 00AEB32A: GetWindowThreadProcessId.USER32(?,?), ref: 00AEB355
                                                            • Part of subcall function 00AEB32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00AE2194,00000034,?,?,00001004,00000000,00000000), ref: 00AEB365
                                                            • Part of subcall function 00AEB32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00AE2194,00000034,?,?,00001004,00000000,00000000), ref: 00AEB37B
                                                          • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00AE27CD
                                                          • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00AE281A
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
                                                          • String ID: @
                                                          • API String ID: 4150878124-2766056989
                                                          • Opcode ID: ca7d2252fdd29c0735d04e8f9d1d248e7a5134b1c29d3a57dd5e633ce5d09dc6
                                                          • Instruction ID: 5bf0e9eeb71c61454d5ed0347c20b5523b7bc21362d68c2290c67235c525883f
                                                          • Opcode Fuzzy Hash: ca7d2252fdd29c0735d04e8f9d1d248e7a5134b1c29d3a57dd5e633ce5d09dc6
                                                          • Instruction Fuzzy Hash: 92412C72900218AFDB10DFA5CD46BEEBBB8EF09700F108095FA55B7181DB706E45CBA1
                                                          Function 00AB172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\file.exe,00000104), ref: 00AB1769
                                                          • _free.LIBCMT ref: 00AB1834
                                                          • _free.LIBCMT ref: 00AB183E
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: _free$FileModuleName
                                                          • String ID: C:\Users\user\Desktop\file.exe
                                                          • API String ID: 2506810119-1957095476
                                                          • Opcode ID: 1afdc9d994c085854c8444e96d12148a2686b6ed4991b84952c65adf0598e0db
                                                          • Instruction ID: 572627929f8a7f4d4da0b61099c63c3f7207513984cc4ba181db879b6bd95fc2
                                                          • Opcode Fuzzy Hash: 1afdc9d994c085854c8444e96d12148a2686b6ed4991b84952c65adf0598e0db
                                                          • Instruction Fuzzy Hash: 1E316D71A40258AFDB21DF999995EDEBBFCEB85310F9441A6F804D7212DA708E80CB90
                                                          Function 00AEC27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00AEC306
                                                          • DeleteMenu.USER32(?,00000007,00000000), ref: 00AEC34C
                                                          • DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00B51990,01696710), ref: 00AEC395
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Menu$Delete$InfoItem
                                                          • String ID: 0
                                                          • API String ID: 135850232-4108050209
                                                          • Opcode ID: dbc3dc96af4dcaab8a7965aa3b344d003ae26940c094baaab35a6797f5c856cc
                                                          • Instruction ID: a77b9f7111cf031f37d61865d5dfa5127be0c1312d5f41c4037338b5286eb6b5
                                                          • Opcode Fuzzy Hash: dbc3dc96af4dcaab8a7965aa3b344d003ae26940c094baaab35a6797f5c856cc
                                                          • Instruction Fuzzy Hash: 6B4191712043829FD724DF26D885F5AFBE8AF85320F14861DF9A59B2D2D730E905CB62
                                                          Function 00B14416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00B1CC08,00000000,?,?,?,?), ref: 00B144AA
                                                          • GetWindowLongW.USER32 ref: 00B144C7
                                                          • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00B144D7
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Window$Long
                                                          • String ID: SysTreeView32
                                                          • API String ID: 847901565-1698111956
                                                          • Opcode ID: 51aa60eca69fdbe60b021d3f57c38c2c4945bdf8c4ffd53c01b2fddfbbbcfbac
                                                          • Instruction ID: 44f242a32ee8d0e22b552f9a6c6be3451fa650e9a7a828fb41cd85ecda9dae71
                                                          • Opcode Fuzzy Hash: 51aa60eca69fdbe60b021d3f57c38c2c4945bdf8c4ffd53c01b2fddfbbbcfbac
                                                          • Instruction Fuzzy Hash: 58317C71250205ABDB209E38DC45BEA7BE9EB18324F608755F979932E0DB70AC909B50
                                                          Function 00B0304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00B0335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00B03077,?,?), ref: 00B03378
                                                          • inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00B0307A
                                                          • _wcslen.LIBCMT ref: 00B0309B
                                                          • htons.WSOCK32(00000000,?,?,00000000), ref: 00B03106
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: ByteCharMultiWide_wcslenhtonsinet_addr
                                                          • String ID: 255.255.255.255
                                                          • API String ID: 946324512-2422070025
                                                          • Opcode ID: 04f91f8924de47d29e179b19293d36fc3a821e45801c64ce38f868b0dea1e897
                                                          • Instruction ID: e40f5f661f350d4fd51d0ccb3644e9b235ed9f1d6b0945cd9094bba93f40cc3c
                                                          • Opcode Fuzzy Hash: 04f91f8924de47d29e179b19293d36fc3a821e45801c64ce38f868b0dea1e897
                                                          • Instruction Fuzzy Hash: ED31C4352002059FC710CF28C5C9FAABBE8EF54714F288099E8159B3D2DB72DE45C761
                                                          Function 00B13EB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00B13F40
                                                          • SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00B13F54
                                                          • SendMessageW.USER32(?,00001002,00000000,?), ref: 00B13F78
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$Window
                                                          • String ID: SysMonthCal32
                                                          • API String ID: 2326795674-1439706946
                                                          • Opcode ID: 3d3cb17fc51caa721973bc06375b6be3224704b9e2e288b4f2dba7329aefed1b
                                                          • Instruction ID: 1daa0874d5ac77f5e9d657999ec622ff43715d739d6257b9b142316557688d2f
                                                          • Opcode Fuzzy Hash: 3d3cb17fc51caa721973bc06375b6be3224704b9e2e288b4f2dba7329aefed1b
                                                          • Instruction Fuzzy Hash: F721BF32640219BFDF218F54CC86FEA3BB9EB48714F110254FA157B1D0DAB1A991CB90
                                                          Function 00B14653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00B14705
                                                          • SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00B14713
                                                          • DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00B1471A
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$DestroyWindow
                                                          • String ID: msctls_updown32
                                                          • API String ID: 4014797782-2298589950
                                                          • Opcode ID: 498bf55fe75f71717402195efd37039113af744455116bf1d4c42c9d3b84bb06
                                                          • Instruction ID: 239a2e4aa15faedb6d7430cda1cf2dba060e17c543c7b8ddbe46fb20c63c92c6
                                                          • Opcode Fuzzy Hash: 498bf55fe75f71717402195efd37039113af744455116bf1d4c42c9d3b84bb06
                                                          • Instruction Fuzzy Hash: 6D2130B5600209AFEB11DF68DCC1DA737EDEB5A7A4B540499FA009B291CB71EC51CB60
                                                          Function 00AE95AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: _wcslen
                                                          • String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
                                                          • API String ID: 176396367-2734436370
                                                          • Opcode ID: e7b66c27e754e014e295a99e471b8bc05dda7cc071a0a998bd548639a58d846b
                                                          • Instruction ID: 0a11f6d79302de643d296d36d6927ab008341e42472fa58e6954daee4d474c90
                                                          • Opcode Fuzzy Hash: e7b66c27e754e014e295a99e471b8bc05dda7cc071a0a998bd548639a58d846b
                                                          • Instruction Fuzzy Hash: F5215772204791A6D731BB269D02FBBB3E89F91300F60442AF94997081EB95ED85C3A5
                                                          Function 00B137B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00B13840
                                                          • SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00B13850
                                                          • MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00B13876
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$MoveWindow
                                                          • String ID: Listbox
                                                          • API String ID: 3315199576-2633736733
                                                          • Opcode ID: ac895b39d2a53753877b5ef28811454bd14f5a07b5f2bca876406ebf754b425d
                                                          • Instruction ID: 80757cc722409ec062b4cabc88a1c84a2143462fe1a9365187eea6da09cb1b23
                                                          • Opcode Fuzzy Hash: ac895b39d2a53753877b5ef28811454bd14f5a07b5f2bca876406ebf754b425d
                                                          • Instruction Fuzzy Hash: F321AC72600218BBEF218F54CC81FEB3BEEEF89B50F508164F9009B190DA719C9287A0
                                                          Function 00AF49F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SetErrorMode.KERNEL32(00000001), ref: 00AF4A08
                                                          • GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00AF4A5C
                                                          • SetErrorMode.KERNEL32(00000000,?,?,00B1CC08), ref: 00AF4AD0
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: ErrorMode$InformationVolume
                                                          • String ID: %lu
                                                          • API String ID: 2507767853-685833217
                                                          • Opcode ID: 2048e27342b9b4796913cb25efd91d21077720e1547bebc80bbabda65d2e5660
                                                          • Instruction ID: 3b607f0b0b279553a4e2d8874e1bf37e2ccfc11ebf271021d8b29a095b762fca
                                                          • Opcode Fuzzy Hash: 2048e27342b9b4796913cb25efd91d21077720e1547bebc80bbabda65d2e5660
                                                          • Instruction Fuzzy Hash: 09312375A40109AFDB10EF54C985EAA7BF8EF09308F148099F509DB252DB71ED45CBA1
                                                          Function 00B141EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00B1424F
                                                          • SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00B14264
                                                          • SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00B14271
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: MessageSend
                                                          • String ID: msctls_trackbar32
                                                          • API String ID: 3850602802-1010561917
                                                          • Opcode ID: c7820a4f6b46011e5e969d9265e9be110c87da91633ce427f273d9c06323f389
                                                          • Instruction ID: 0b01477a86a320ca22bf44b4dae4edaea86c8a86b8379dbd8754208dd15bf91e
                                                          • Opcode Fuzzy Hash: c7820a4f6b46011e5e969d9265e9be110c87da91633ce427f273d9c06323f389
                                                          • Instruction Fuzzy Hash: 7F11CE31290208BEEF205E28CC06FEB3BECEB95B64F114524FA55E60A0D671DCA19B60
                                                          Function 00AE2F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00A86B57: _wcslen.LIBCMT ref: 00A86B6A
                                                            • Part of subcall function 00AE2DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00AE2DC5
                                                            • Part of subcall function 00AE2DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 00AE2DD6
                                                            • Part of subcall function 00AE2DA7: GetCurrentThreadId.KERNEL32 ref: 00AE2DDD
                                                            • Part of subcall function 00AE2DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00AE2DE4
                                                          • GetFocus.USER32 ref: 00AE2F78
                                                            • Part of subcall function 00AE2DEE: GetParent.USER32(00000000), ref: 00AE2DF9
                                                          • GetClassNameW.USER32(?,?,00000100), ref: 00AE2FC3
                                                          • EnumChildWindows.USER32(?,00AE303B), ref: 00AE2FEB
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
                                                          • String ID: %s%d
                                                          • API String ID: 1272988791-1110647743
                                                          • Opcode ID: 97401648eb29ba1abb402a51c7226c1b1da4f4d402c9321214c549b27bc14bcf
                                                          • Instruction ID: efc6d72d272da244775d9d9215a0d75c7888983d80aa7422ca570cef7e8a4bf9
                                                          • Opcode Fuzzy Hash: 97401648eb29ba1abb402a51c7226c1b1da4f4d402c9321214c549b27bc14bcf
                                                          • Instruction Fuzzy Hash: 1611B4756002456BDF147F758DC9FEE37AAAF94314F048075FA099B152DE309A458B60
                                                          Function 00B15882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00B158C1
                                                          • SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00B158EE
                                                          • DrawMenuBar.USER32(?), ref: 00B158FD
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Menu$InfoItem$Draw
                                                          • String ID: 0
                                                          • API String ID: 3227129158-4108050209
                                                          • Opcode ID: 4544eb67c2b2dbeae685acc5a62a83acae3a95f4f993c10f87d598cba4939ce3
                                                          • Instruction ID: 046e64ad28a38bc30aadede0fcce2de28980be1b8d52025721961c323494180f
                                                          • Opcode Fuzzy Hash: 4544eb67c2b2dbeae685acc5a62a83acae3a95f4f993c10f87d598cba4939ce3
                                                          • Instruction Fuzzy Hash: 5B015B31600218EFDB219F11DC85BEEBBB9FB85360F5080A9E849D6251DB308A84DF21
                                                          Function 00AE007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: e0051a6ffd701ccdb0d8792e8e576e7049d2213f790995b51572fdc369250294
                                                          • Instruction ID: dfa12a2a89c6d37102d49b105bc21cd143ea9de57d89c873192da0f136634068
                                                          • Opcode Fuzzy Hash: e0051a6ffd701ccdb0d8792e8e576e7049d2213f790995b51572fdc369250294
                                                          • Instruction Fuzzy Hash: 9FC14875A0024AAFCB14CFA9C894EAEB7B5FF48304F218598E505EF251D771EE81DB90
                                                          Function 00AB3E80 Relevance: 6.3, APIs: 4, Instructions: 305COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: __alldvrm$_strrchr
                                                          • String ID:
                                                          • API String ID: 1036877536-0
                                                          • Opcode ID: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
                                                          • Instruction ID: 3d6c98627804c329d5ec1f2aed55f3a2956d35f265b81b4dec48013c2291fb28
                                                          • Opcode Fuzzy Hash: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
                                                          • Instruction Fuzzy Hash: C2A11772E003869FEB15DF28C8917FABBF9EF6A350F14426DE5959B283C2388941C750
                                                          Function 00B0342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Variant$ClearInitInitializeUninitialize
                                                          • String ID:
                                                          • API String ID: 1998397398-0
                                                          • Opcode ID: 2eb5b93b5be3dc53679a8770480fd4be470ec536072e67bebdd4414821224e25
                                                          • Instruction ID: bdcabf6bbb7c368e807613c973552bbd64aac075157f06bda63c00c7e5fb02fe
                                                          • Opcode Fuzzy Hash: 2eb5b93b5be3dc53679a8770480fd4be470ec536072e67bebdd4414821224e25
                                                          • Instruction Fuzzy Hash: 6FA13F756043009FC714EF28C585A2EBBE9FF88714F148899F99A9B3A2DB31ED05CB51
                                                          Function 00AE0436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00B1FC08,?), ref: 00AE05F0
                                                          • CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00B1FC08,?), ref: 00AE0608
                                                          • CLSIDFromProgID.OLE32(?,?,00000000,00B1CC40,000000FF,?,00000000,00000800,00000000,?,00B1FC08,?), ref: 00AE062D
                                                          • _memcmp.LIBVCRUNTIME ref: 00AE064E
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: FromProg$FreeTask_memcmp
                                                          • String ID:
                                                          • API String ID: 314563124-0
                                                          • Opcode ID: c110d143f78d168531444312f48d7a33d9c3653483257f419ed1632c68c9be90
                                                          • Instruction ID: 59a3fde26617507f2eeb5e8e5a027645a068ab680247ba57fe7d6e2b604dcbdc
                                                          • Opcode Fuzzy Hash: c110d143f78d168531444312f48d7a33d9c3653483257f419ed1632c68c9be90
                                                          • Instruction Fuzzy Hash: AE811B71A00109EFCB04DF95C984EEEB7B9FF89315F208598E516AB250DB71AE46CF60
                                                          Function 00AC1391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: _free
                                                          • String ID:
                                                          • API String ID: 269201875-0
                                                          • Opcode ID: 9b92d106390141dd330caa11b5583f0d7a0a8d953d4fc7e9bb7cf91c4fec89da
                                                          • Instruction ID: 7a6cb4d290ab3c359244fecce8d3914ba924e65367c814c7b7814af62eb2cf05
                                                          • Opcode Fuzzy Hash: 9b92d106390141dd330caa11b5583f0d7a0a8d953d4fc7e9bb7cf91c4fec89da
                                                          • Instruction Fuzzy Hash: 26412B75B00500ABDB296BF98E45FFE3AA9EF43370F16462DF419D7293E73448415261
                                                          Function 00B16278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetWindowRect.USER32(?,?), ref: 00B162E2
                                                          • ScreenToClient.USER32(?,?), ref: 00B16315
                                                          • MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00B16382
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Window$ClientMoveRectScreen
                                                          • String ID:
                                                          • API String ID: 3880355969-0
                                                          • Opcode ID: 84f78ea3ed68394db6ce4601be8e84092659de1787d082b18d77b387e4e20329
                                                          • Instruction ID: 02d9bb15993257b216982d689c1f4f18d5fce2879ec0b66276d4357bd66456af
                                                          • Opcode Fuzzy Hash: 84f78ea3ed68394db6ce4601be8e84092659de1787d082b18d77b387e4e20329
                                                          • Instruction Fuzzy Hash: E4510A74A00209EFDB14DF68D980AEE7BF5EB45360F5085A9F8259B290DB70ED81CB90
                                                          Function 00B01AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • socket.WSOCK32(00000002,00000002,00000011), ref: 00B01AFD
                                                          • WSAGetLastError.WSOCK32 ref: 00B01B0B
                                                          • #21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00B01B8A
                                                          • WSAGetLastError.WSOCK32 ref: 00B01B94
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: ErrorLast$socket
                                                          • String ID:
                                                          • API String ID: 1881357543-0
                                                          • Opcode ID: f7c9238930ad61d36ead07b064793d5cde1c7fff05bab8acf3bd9ed667f8d9bd
                                                          • Instruction ID: 7ce4c115fbeeddc879471a7638306e1573c42455ed6bcee579dccb6d26265317
                                                          • Opcode Fuzzy Hash: f7c9238930ad61d36ead07b064793d5cde1c7fff05bab8acf3bd9ed667f8d9bd
                                                          • Instruction Fuzzy Hash: 8F41A034640200AFE724AF24C986F697BE5EB44718F54C498FA1A9F7D2D772DD418B90
                                                          Function 00ABB41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 1f034f40f7dc4ed038bd624d78a31cb885113cc0817b04253a5712e5b681e413
                                                          • Instruction ID: 03d99683938e3ae80aa54c49b9e01be04bffa54306d26d7d183028b0d9fd28dd
                                                          • Opcode Fuzzy Hash: 1f034f40f7dc4ed038bd624d78a31cb885113cc0817b04253a5712e5b681e413
                                                          • Instruction Fuzzy Hash: D441F771A10704AFD7249F78CD41BEABBEDEB89710F10862EF156DB283D7B1994187A0
                                                          Function 00AF56D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00AF5783
                                                          • GetLastError.KERNEL32(?,00000000), ref: 00AF57A9
                                                          • DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00AF57CE
                                                          • CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00AF57FA
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: CreateHardLink$DeleteErrorFileLast
                                                          • String ID:
                                                          • API String ID: 3321077145-0
                                                          • Opcode ID: 62055b8c2a6b1be29b1c3f52483061b644ca4990450da27e457380c3e7c93ce5
                                                          • Instruction ID: 0078210baf9718f1a0def4a1369c98950d4ce570610a233f0b35da1128776dc6
                                                          • Opcode Fuzzy Hash: 62055b8c2a6b1be29b1c3f52483061b644ca4990450da27e457380c3e7c93ce5
                                                          • Instruction Fuzzy Hash: AC412C35600610DFCB15EF55C544A5DBBE1AF49720B18C888E95A5B362CB30FD40CB91
                                                          Function 00ABD8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • MultiByteToWideChar.KERNEL32(?,00000000,8BE85006,00AA6D71,00000000,00000000,00AA82D9,?,00AA82D9,?,00000001,00AA6D71,8BE85006,00000001,00AA82D9,00AA82D9), ref: 00ABD910
                                                          • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00ABD999
                                                          • GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00ABD9AB
                                                          • __freea.LIBCMT ref: 00ABD9B4
                                                            • Part of subcall function 00AB3820: RtlAllocateHeap.NTDLL(00000000,?,00B51444,?,00A9FDF5,?,?,00A8A976,00000010,00B51440,00A813FC,?,00A813C6,?,00A81129), ref: 00AB3852
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: ByteCharMultiWide$AllocateHeapStringType__freea
                                                          • String ID:
                                                          • API String ID: 2652629310-0
                                                          • Opcode ID: a6b8f3ed7c547935e78faf7eb58da2931c04f026c1305df016a9ca446ab76c4c
                                                          • Instruction ID: 848f9a95a4ee5198f7e16b12227cef35be603173b7e6d5f7dd8701b95e046ff2
                                                          • Opcode Fuzzy Hash: a6b8f3ed7c547935e78faf7eb58da2931c04f026c1305df016a9ca446ab76c4c
                                                          • Instruction Fuzzy Hash: 9431BC72A0020AABDF249F64DC41EEE7BA9EB41710F154268FC04D7292EB36CD50CBA0
                                                          Function 00B152C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SendMessageW.USER32(?,00001024,00000000,?), ref: 00B15352
                                                          • GetWindowLongW.USER32(?,000000F0), ref: 00B15375
                                                          • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00B15382
                                                          • InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00B153A8
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: LongWindow$InvalidateMessageRectSend
                                                          • String ID:
                                                          • API String ID: 3340791633-0
                                                          • Opcode ID: f638550ef3d39fe2c2482048902e994f99ccdd7937ce8c8e5a5f5ce4fd2b213a
                                                          • Instruction ID: 30447c887dbc950920c002c5c8517420af647d544b993bb995aa25595780482d
                                                          • Opcode Fuzzy Hash: f638550ef3d39fe2c2482048902e994f99ccdd7937ce8c8e5a5f5ce4fd2b213a
                                                          • Instruction Fuzzy Hash: 4231C634A55A0CEFEB349E14EC45BE837E5EB85390FD44182FA22971E1C7B09DC0AB49
                                                          Function 00AEAB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 00AEABF1
                                                          • SetKeyboardState.USER32(00000080,?,00008000), ref: 00AEAC0D
                                                          • PostMessageW.USER32(00000000,00000101,00000000), ref: 00AEAC74
                                                          • SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 00AEACC6
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: KeyboardState$InputMessagePostSend
                                                          • String ID:
                                                          • API String ID: 432972143-0
                                                          • Opcode ID: 074fd6b7ecff42f864e17cb8d1103f05cac38f80aa425a1294c9049b23548b94
                                                          • Instruction ID: 431399e90c4e3fc0ba18830e5eed54065d647db6c11c810a0098c6bbef7faf5b
                                                          • Opcode Fuzzy Hash: 074fd6b7ecff42f864e17cb8d1103f05cac38f80aa425a1294c9049b23548b94
                                                          • Instruction Fuzzy Hash: 02310730A407986FEF35CBA68C057FE7BB5ABE9310F28831AE485931D1C375A9858753
                                                          Function 00B17674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • ClientToScreen.USER32(?,?), ref: 00B1769A
                                                          • GetWindowRect.USER32(?,?), ref: 00B17710
                                                          • PtInRect.USER32(?,?,00B18B89), ref: 00B17720
                                                          • MessageBeep.USER32(00000000), ref: 00B1778C
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Rect$BeepClientMessageScreenWindow
                                                          • String ID:
                                                          • API String ID: 1352109105-0
                                                          • Opcode ID: f4c277ba797cd8294015431adffaa5d04caf088dde41e56f9630dbf087cb9ef1
                                                          • Instruction ID: aa768605f9d3ace40fb2d1a48a6e977063e0f39faef666e6a8a9304286d65367
                                                          • Opcode Fuzzy Hash: f4c277ba797cd8294015431adffaa5d04caf088dde41e56f9630dbf087cb9ef1
                                                          • Instruction Fuzzy Hash: 00415C74645214DFCB12CF58C894FE9BBF5FB49315F9581E8E4249B2A1CB30AD82CB90
                                                          Function 00B116DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetForegroundWindow.USER32 ref: 00B116EB
                                                            • Part of subcall function 00AE3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00AE3A57
                                                            • Part of subcall function 00AE3A3D: GetCurrentThreadId.KERNEL32 ref: 00AE3A5E
                                                            • Part of subcall function 00AE3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00AE25B3), ref: 00AE3A65
                                                          • GetCaretPos.USER32(?), ref: 00B116FF
                                                          • ClientToScreen.USER32(00000000,?), ref: 00B1174C
                                                          • GetForegroundWindow.USER32 ref: 00B11752
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
                                                          • String ID:
                                                          • API String ID: 2759813231-0
                                                          • Opcode ID: 22d285651f354046bb8acbee78ee73d68763d9f413df2702cf9bfd5f418500ee
                                                          • Instruction ID: fe2998b1408d215ccf8b39ec7f13314db4f6090f6b29ad75e9ec2570412a37b4
                                                          • Opcode Fuzzy Hash: 22d285651f354046bb8acbee78ee73d68763d9f413df2702cf9bfd5f418500ee
                                                          • Instruction Fuzzy Hash: 95314FB1D00249AFDB00EFA9C985CEEBBF9EF48304B5080A9E515E7251DB31DE45CBA1
                                                          Function 00AEDF95 Relevance: 6.1, APIs: 4, Instructions: 87COMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00A87620: _wcslen.LIBCMT ref: 00A87625
                                                          • _wcslen.LIBCMT ref: 00AEDFCB
                                                          • _wcslen.LIBCMT ref: 00AEDFE2
                                                          • _wcslen.LIBCMT ref: 00AEE00D
                                                          • GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 00AEE018
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: _wcslen$ExtentPoint32Text
                                                          • String ID:
                                                          • API String ID: 3763101759-0
                                                          • Opcode ID: 41597d088d2b48cd9adfd580e155b33d2bf093156247fce5a5e11cd5f9e57aa7
                                                          • Instruction ID: 1aa2b32dcfb2eb96864cf138d7928c7be2ba0669b1b2f5e431d9c60f125b631c
                                                          • Opcode Fuzzy Hash: 41597d088d2b48cd9adfd580e155b33d2bf093156247fce5a5e11cd5f9e57aa7
                                                          • Instruction Fuzzy Hash: DC219571940214EFCB10EFA9DA81BAEB7F8EF8A750F144065F805BB285D7709E41CBA1
                                                          Function 00AED4DC Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CreateToolhelp32Snapshot.KERNEL32 ref: 00AED501
                                                          • Process32FirstW.KERNEL32(00000000,?), ref: 00AED50F
                                                          • Process32NextW.KERNEL32(00000000,?), ref: 00AED52F
                                                          • CloseHandle.KERNEL32(00000000), ref: 00AED5DC
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
                                                          • String ID:
                                                          • API String ID: 420147892-0
                                                          • Opcode ID: 04286c35aee12d17553033f64fb6c3feaae8c29f7aa72a631696002ca8d9d7bd
                                                          • Instruction ID: debf30f4b40d667d9fcafc999303fabec5d79a929a5b28caddced2258c6a4f65
                                                          • Opcode Fuzzy Hash: 04286c35aee12d17553033f64fb6c3feaae8c29f7aa72a631696002ca8d9d7bd
                                                          • Instruction Fuzzy Hash: E131AB71108340AFD300EF64C985ABFBBF8EF99354F54092DF585971A1EB719A48CBA2
                                                          Function 00B18FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00A99BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00A99BB2
                                                          • GetCursorPos.USER32(?), ref: 00B19001
                                                          • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00AD7711,?,?,?,?,?), ref: 00B19016
                                                          • GetCursorPos.USER32(?), ref: 00B1905E
                                                          • DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00AD7711,?,?,?), ref: 00B19094
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Cursor$LongMenuPopupProcTrackWindow
                                                          • String ID:
                                                          • API String ID: 2864067406-0
                                                          • Opcode ID: 1c71b671e93c4cef063449697ea06dc9a3c663114ca004df00f61f9d368b4790
                                                          • Instruction ID: 8257312b48e8a22c385b67a91147fa22e0e1ec8f93ae8f1f205b40177bbca1cd
                                                          • Opcode Fuzzy Hash: 1c71b671e93c4cef063449697ea06dc9a3c663114ca004df00f61f9d368b4790
                                                          • Instruction Fuzzy Hash: 5D219F35600158EFCB25CF98CC69FEA7BF9EB49361F9440A9F90547261C7319D90DB60
                                                          Function 00AED2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetFileAttributesW.KERNEL32(?,00B1CB68), ref: 00AED2FB
                                                          • GetLastError.KERNEL32 ref: 00AED30A
                                                          • CreateDirectoryW.KERNEL32(?,00000000), ref: 00AED319
                                                          • CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,00B1CB68), ref: 00AED376
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: CreateDirectory$AttributesErrorFileLast
                                                          • String ID:
                                                          • API String ID: 2267087916-0
                                                          • Opcode ID: a8e85f408d67f3f42803662d087c0a040f2c94f90ceba1a413b198f01a7f5cff
                                                          • Instruction ID: a286d5f5618841d99346c8e3eaea8ebcf66f8391cbca1c610bd319b7fd01a2b5
                                                          • Opcode Fuzzy Hash: a8e85f408d67f3f42803662d087c0a040f2c94f90ceba1a413b198f01a7f5cff
                                                          • Instruction Fuzzy Hash: 2321B2745083429F8710EF29C9818AFBBE4EE5A324F504A1DF499DB2E1DB30D945CB93
                                                          Function 00AE1571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00AE1014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00AE102A
                                                            • Part of subcall function 00AE1014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00AE1036
                                                            • Part of subcall function 00AE1014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00AE1045
                                                            • Part of subcall function 00AE1014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00AE104C
                                                            • Part of subcall function 00AE1014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00AE1062
                                                          • LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00AE15BE
                                                          • _memcmp.LIBVCRUNTIME ref: 00AE15E1
                                                          • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00AE1617
                                                          • HeapFree.KERNEL32(00000000), ref: 00AE161E
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
                                                          • String ID:
                                                          • API String ID: 1592001646-0
                                                          • Opcode ID: e90cc562b945d52d2a1a2918d5caaf9c93c5eeaf7263fb0cf13c2d95be007bd5
                                                          • Instruction ID: b41f2110c9f47ef8485a03d9e48d6862dbb7cbffffe2ca4195aa633f5abc11f6
                                                          • Opcode Fuzzy Hash: e90cc562b945d52d2a1a2918d5caaf9c93c5eeaf7263fb0cf13c2d95be007bd5
                                                          • Instruction Fuzzy Hash: 27218E71E40219EFDF10DFA6C949BEEB7B8EF44354F188459E445AB241E731AE05CBA0
                                                          Function 00B12782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetWindowLongW.USER32(?,000000EC), ref: 00B1280A
                                                          • SetWindowLongW.USER32(?,000000EC,00000000), ref: 00B12824
                                                          • SetWindowLongW.USER32(?,000000EC,00000000), ref: 00B12832
                                                          • SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00B12840
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Window$Long$AttributesLayered
                                                          • String ID:
                                                          • API String ID: 2169480361-0
                                                          • Opcode ID: 6dd1b5398585125dce17fe33f5732a68557a5a5360d2f53c64b3f527972406a2
                                                          • Instruction ID: e96ddc2b66a01df7f8c6ff5e9b9c1bee5d8285b886ab23315a6a812cd68f065d
                                                          • Opcode Fuzzy Hash: 6dd1b5398585125dce17fe33f5732a68557a5a5360d2f53c64b3f527972406a2
                                                          • Instruction Fuzzy Hash: CA21B031205511AFD7149B24D845FEA7B96EF86324F548198F826CB6E2CB71FC92CBD0
                                                          Function 00AE78F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00AE8D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,00AE790A,?,000000FF,?,00AE8754,00000000,?,0000001C,?,?), ref: 00AE8D8C
                                                            • Part of subcall function 00AE8D7D: lstrcpyW.KERNEL32(00000000,?,?,00AE790A,?,000000FF,?,00AE8754,00000000,?,0000001C,?,?,00000000), ref: 00AE8DB2
                                                            • Part of subcall function 00AE8D7D: lstrcmpiW.KERNEL32(00000000,?,00AE790A,?,000000FF,?,00AE8754,00000000,?,0000001C,?,?), ref: 00AE8DE3
                                                          • lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00AE8754,00000000,?,0000001C,?,?,00000000), ref: 00AE7923
                                                          • lstrcpyW.KERNEL32(00000000,?,?,00AE8754,00000000,?,0000001C,?,?,00000000), ref: 00AE7949
                                                          • lstrcmpiW.KERNEL32(00000002,cdecl,?,00AE8754,00000000,?,0000001C,?,?,00000000), ref: 00AE7984
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: lstrcmpilstrcpylstrlen
                                                          • String ID: cdecl
                                                          • API String ID: 4031866154-3896280584
                                                          • Opcode ID: 29ec32684cea1473b2422265b8a943cf8f6dad848e99e95f5f48eca809497d6c
                                                          • Instruction ID: 7aa42df7300fdfca5fdd56fbf71b466edbc2bf60f84d5fec1028422d81d58ff4
                                                          • Opcode Fuzzy Hash: 29ec32684cea1473b2422265b8a943cf8f6dad848e99e95f5f48eca809497d6c
                                                          • Instruction Fuzzy Hash: 8611D33A200382AFCB159F36DC45E7A77E9FF85750B50802AF946C72A5EF319811D7A1
                                                          Function 00B17CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetWindowLongW.USER32(?,000000F0), ref: 00B17D0B
                                                          • SetWindowLongW.USER32(00000000,000000F0,?), ref: 00B17D2A
                                                          • SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00B17D42
                                                          • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00AFB7AD,00000000), ref: 00B17D6B
                                                            • Part of subcall function 00A99BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00A99BB2
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Window$Long
                                                          • String ID:
                                                          • API String ID: 847901565-0
                                                          • Opcode ID: 35124e5a348ab933d3758287120625fad6ef116b5deaef6c20757f4c862fee83
                                                          • Instruction ID: a2af15a61b500a88f66be275ba0ce47d3d8d5ee949e6583356e55ce1c3fd7829
                                                          • Opcode Fuzzy Hash: 35124e5a348ab933d3758287120625fad6ef116b5deaef6c20757f4c862fee83
                                                          • Instruction Fuzzy Hash: 7311AE71284618AFCB108F28DC04AE63BE5EF45364B5187A4F835C72E0DB3089A1CB80
                                                          Function 00B15660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SendMessageW.USER32(?,00001060,?,00000004), ref: 00B156BB
                                                          • _wcslen.LIBCMT ref: 00B156CD
                                                          • _wcslen.LIBCMT ref: 00B156D8
                                                          • SendMessageW.USER32(?,00001002,00000000,?), ref: 00B15816
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: MessageSend_wcslen
                                                          • String ID:
                                                          • API String ID: 455545452-0
                                                          • Opcode ID: b6b3440077730e70a61baa3fb3169d8ca1d964c2be5be6619249ab367649466a
                                                          • Instruction ID: ff6d657b61007254bb3865baeb91a2b5a2cc3c7ad277c5d632a060197f0b8959
                                                          • Opcode Fuzzy Hash: b6b3440077730e70a61baa3fb3169d8ca1d964c2be5be6619249ab367649466a
                                                          • Instruction Fuzzy Hash: 6D11E131600608DADB309F65CCC1AEE77ECEF95364B9040A6F915D7185EB708AC0CBA0
                                                          Function 00AB1D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: fa6f8256232fe39a59e33b255130bfc3580542e53f95d12b4d936e1f93696e18
                                                          • Instruction ID: 09a7772be6a12e7c23c3f72df18619116cdbae3eb82430631556e523cb747f92
                                                          • Opcode Fuzzy Hash: fa6f8256232fe39a59e33b255130bfc3580542e53f95d12b4d936e1f93696e18
                                                          • Instruction Fuzzy Hash: 9701ADB220961A7EF62126786CD0FE76B6CDF817B8FB00326F525A21D3DB608C105160
                                                          Function 00AE1A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SendMessageW.USER32(?,000000B0,?,?), ref: 00AE1A47
                                                          • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00AE1A59
                                                          • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00AE1A6F
                                                          • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00AE1A8A
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: MessageSend
                                                          • String ID:
                                                          • API String ID: 3850602802-0
                                                          • Opcode ID: 1b26749355b095b9e1af9a9f4e0fca13616586657272f000c5e0746286dc6c87
                                                          • Instruction ID: ce0c25d109c77da81e7175077db278790737dbf50564bd3a4dbcf329394a7dd3
                                                          • Opcode Fuzzy Hash: 1b26749355b095b9e1af9a9f4e0fca13616586657272f000c5e0746286dc6c87
                                                          • Instruction Fuzzy Hash: EB11093AD41229FFEB11DBA5CD85FADBB78EB08750F2000A1EA05B7290D6716E50DB94
                                                          Function 00AEE1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetCurrentThreadId.KERNEL32 ref: 00AEE1FD
                                                          • MessageBoxW.USER32(?,?,?,?), ref: 00AEE230
                                                          • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00AEE246
                                                          • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00AEE24D
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: CloseCurrentHandleMessageObjectSingleThreadWait
                                                          • String ID:
                                                          • API String ID: 2880819207-0
                                                          • Opcode ID: 1ddf2ef8e9f63da237eed4d914bdad5294d7da642e0316b54c32619cf78c0d80
                                                          • Instruction ID: c1253d33ac23d696940bb0aa0c3c8d53a9d6b7b0b54f6a3d9d0ef77237cec715
                                                          • Opcode Fuzzy Hash: 1ddf2ef8e9f63da237eed4d914bdad5294d7da642e0316b54c32619cf78c0d80
                                                          • Instruction Fuzzy Hash: 6111C876904254BBCB01DFAD9C05BDE7FADEB45311F148655F925E3291DAB08D048BA0
                                                          Function 00AAD1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CreateThread.KERNEL32(00000000,?,00AACFF9,00000000,00000004,00000000), ref: 00AAD218
                                                          • GetLastError.KERNEL32 ref: 00AAD224
                                                          • __dosmaperr.LIBCMT ref: 00AAD22B
                                                          • ResumeThread.KERNEL32(00000000), ref: 00AAD249
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Thread$CreateErrorLastResume__dosmaperr
                                                          • String ID:
                                                          • API String ID: 173952441-0
                                                          • Opcode ID: 0af6841e362be37951f5f4d1ec708c05b82ba3d035dad04fa60538608a88eb50
                                                          • Instruction ID: 3a4623f1bddd6842abcb7fc45820452edfdafc96f4517f0514a0487463300b7f
                                                          • Opcode Fuzzy Hash: 0af6841e362be37951f5f4d1ec708c05b82ba3d035dad04fa60538608a88eb50
                                                          • Instruction Fuzzy Hash: 1701C076845204BBDB216BA5DC09BEE7E69EF83330F104229F926935D0DF708905C6A0
                                                          Function 00B19EF3 Relevance: 6.1, APIs: 4, Instructions: 55COMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00A99BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00A99BB2
                                                          • GetClientRect.USER32(?,?), ref: 00B19F31
                                                          • GetCursorPos.USER32(?), ref: 00B19F3B
                                                          • ScreenToClient.USER32(?,?), ref: 00B19F46
                                                          • DefDlgProcW.USER32(?,00000020,?,00000000,?,?,?), ref: 00B19F7A
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Client$CursorLongProcRectScreenWindow
                                                          • String ID:
                                                          • API String ID: 4127811313-0
                                                          • Opcode ID: 879d0b406c0ca5eea2b0d55fefd3c30cab0250300cba4865a8bdf5592b6b65d4
                                                          • Instruction ID: 7762cc8d0b2d46326bc0ae461edc1d0160ea906a8a3f5af722259166ea4821e3
                                                          • Opcode Fuzzy Hash: 879d0b406c0ca5eea2b0d55fefd3c30cab0250300cba4865a8bdf5592b6b65d4
                                                          • Instruction Fuzzy Hash: 71115A3290025ABBDB10DF68C8999EE7BF9FB05311F904495F911E3140D730BAC2CBA1
                                                          Function 00A8600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00A8604C
                                                          • GetStockObject.GDI32(00000011), ref: 00A86060
                                                          • SendMessageW.USER32(00000000,00000030,00000000), ref: 00A8606A
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: CreateMessageObjectSendStockWindow
                                                          • String ID:
                                                          • API String ID: 3970641297-0
                                                          • Opcode ID: 876f515731628bc48a96007c20cc38fc7a70436c2e40502da481693acb2a8cf8
                                                          • Instruction ID: ac67d790e2e12b8246c83db20d512fc323702d02894a086cfd661ed20879adbf
                                                          • Opcode Fuzzy Hash: 876f515731628bc48a96007c20cc38fc7a70436c2e40502da481693acb2a8cf8
                                                          • Instruction Fuzzy Hash: 2F116D72501508BFEF125FA49C54FEABF79EF083A5F048215FA1452150DB329C60DBA5
                                                          Function 00AA3B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          • ___BuildCatchObject.LIBVCRUNTIME ref: 00AA3B56
                                                            • Part of subcall function 00AA3AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 00AA3AD2
                                                            • Part of subcall function 00AA3AA3: ___AdjustPointer.LIBCMT ref: 00AA3AED
                                                          • _UnwindNestedFrames.LIBCMT ref: 00AA3B6B
                                                          • __FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00AA3B7C
                                                          • CallCatchBlock.LIBVCRUNTIME ref: 00AA3BA4
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
                                                          • String ID:
                                                          • API String ID: 737400349-0
                                                          • Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
                                                          • Instruction ID: 5f1ebb6a4ea588ae01599e41dc7aec32c2d817bf2e2b74d4386c2a8ea009a06f
                                                          • Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
                                                          • Instruction Fuzzy Hash: 5C011732100148BBDF126F95DD42EEB7B6AEF8A754F044018FE4857161C772E9619BA0
                                                          Function 00AB3073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00A813C6,00000000,00000000,?,00AB301A,00A813C6,00000000,00000000,00000000,?,00AB328B,00000006,FlsSetValue), ref: 00AB30A5
                                                          • GetLastError.KERNEL32(?,00AB301A,00A813C6,00000000,00000000,00000000,?,00AB328B,00000006,FlsSetValue,00B22290,FlsSetValue,00000000,00000364,?,00AB2E46), ref: 00AB30B1
                                                          • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00AB301A,00A813C6,00000000,00000000,00000000,?,00AB328B,00000006,FlsSetValue,00B22290,FlsSetValue,00000000), ref: 00AB30BF
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: LibraryLoad$ErrorLast
                                                          • String ID:
                                                          • API String ID: 3177248105-0
                                                          • Opcode ID: 2870e7d44bba079c35e9cfe09bf5380bf00a93da77b916b0db196def42a5e3ba
                                                          • Instruction ID: e1c07bd83d07ac288309b3d3ef2456d27420a2131ca39aa4f69f4a4da7b1e125
                                                          • Opcode Fuzzy Hash: 2870e7d44bba079c35e9cfe09bf5380bf00a93da77b916b0db196def42a5e3ba
                                                          • Instruction Fuzzy Hash: 5B01D437745322ABCF315B78AC44AD77B9CAF05B61B604620F906E7141CB21D901C6E0
                                                          Function 00AE7464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 00AE747F
                                                          • LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00AE7497
                                                          • RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 00AE74AC
                                                          • RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 00AE74CA
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Type$Register$FileLoadModuleNameUser
                                                          • String ID:
                                                          • API String ID: 1352324309-0
                                                          • Opcode ID: 764085c5ec43042e0e8ea2dd415e7ecd11bf52d30f63d934a536000a6dbaed4e
                                                          • Instruction ID: 39cbc3574eef8e176509798ee2b37470017d370202f64fca66082844cb399140
                                                          • Opcode Fuzzy Hash: 764085c5ec43042e0e8ea2dd415e7ecd11bf52d30f63d934a536000a6dbaed4e
                                                          • Instruction Fuzzy Hash: 2911C0B5249354AFE720CF19EC08F9A7FFCEB00B00F508569AA16DB191DBB0E904DB60
                                                          Function 00AEB0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00AEACD3,?,00008000), ref: 00AEB0C4
                                                          • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00AEACD3,?,00008000), ref: 00AEB0E9
                                                          • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00AEACD3,?,00008000), ref: 00AEB0F3
                                                          • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00AEACD3,?,00008000), ref: 00AEB126
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: CounterPerformanceQuerySleep
                                                          • String ID:
                                                          • API String ID: 2875609808-0
                                                          • Opcode ID: dec7312deb7b900406594f4e9b68e1d21c17dbdad4085167d556d7ebe8a70672
                                                          • Instruction ID: b7eccab7837ed9a258d33b4b84e0ed9e21c3b09144b269af3ff5823fdab6d9ae
                                                          • Opcode Fuzzy Hash: dec7312deb7b900406594f4e9b68e1d21c17dbdad4085167d556d7ebe8a70672
                                                          • Instruction Fuzzy Hash: F8113931D51668E7CF00AFEAE9986EFBF78FF09721F108186D941B3181CB3056509B61
                                                          Function 00B17E14 Relevance: 6.0, APIs: 4, Instructions: 46COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetWindowRect.USER32(?,?), ref: 00B17E33
                                                          • ScreenToClient.USER32(?,?), ref: 00B17E4B
                                                          • ScreenToClient.USER32(?,?), ref: 00B17E6F
                                                          • InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00B17E8A
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: ClientRectScreen$InvalidateWindow
                                                          • String ID:
                                                          • API String ID: 357397906-0
                                                          • Opcode ID: e17b4ebabd5a93e2478db96bf53c98214831750bcb6a71a6bdeb3a00bdd731d9
                                                          • Instruction ID: cb7138445afde10a599c7e10b8bf7ce63e16626ca6aa0ae5705a5cd50520c748
                                                          • Opcode Fuzzy Hash: e17b4ebabd5a93e2478db96bf53c98214831750bcb6a71a6bdeb3a00bdd731d9
                                                          • Instruction Fuzzy Hash: 611143B9D4020AAFDB41CF98C8849EEBBF9FB09310F509056E915E3210D775AA54CF50
                                                          Function 00AE2DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00AE2DC5
                                                          • GetWindowThreadProcessId.USER32(?,00000000), ref: 00AE2DD6
                                                          • GetCurrentThreadId.KERNEL32 ref: 00AE2DDD
                                                          • AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00AE2DE4
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
                                                          • String ID:
                                                          • API String ID: 2710830443-0
                                                          • Opcode ID: 7d813e1b1cd9705c103bdaa2943cd108aed26b5ec49836f25be04420b9aa0e48
                                                          • Instruction ID: c810ce456f17117b126c3d3f2077dd9ff58eb24325f1a103051e0ed3cda53541
                                                          • Opcode Fuzzy Hash: 7d813e1b1cd9705c103bdaa2943cd108aed26b5ec49836f25be04420b9aa0e48
                                                          • Instruction Fuzzy Hash: 79E06D715812247AD7201B639C4DFEB3E6CEB42BA1F904115B205D3080DEA08840C6B0
                                                          Function 00B18863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00A99639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00A99693
                                                            • Part of subcall function 00A99639: SelectObject.GDI32(?,00000000), ref: 00A996A2
                                                            • Part of subcall function 00A99639: BeginPath.GDI32(?), ref: 00A996B9
                                                            • Part of subcall function 00A99639: SelectObject.GDI32(?,00000000), ref: 00A996E2
                                                          • MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00B18887
                                                          • LineTo.GDI32(?,?,?), ref: 00B18894
                                                          • EndPath.GDI32(?), ref: 00B188A4
                                                          • StrokePath.GDI32(?), ref: 00B188B2
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
                                                          • String ID:
                                                          • API String ID: 1539411459-0
                                                          • Opcode ID: 3fa39ffe5406faa88db0a33f53207ac172973346409060cf7b0d4b83c4addfec
                                                          • Instruction ID: e666af22e73f205a2754a5af1f31cf0930c2c3581d8065468559784afcfcb517
                                                          • Opcode Fuzzy Hash: 3fa39ffe5406faa88db0a33f53207ac172973346409060cf7b0d4b83c4addfec
                                                          • Instruction Fuzzy Hash: A0F05E36081258FADB125F98AC0EFCE3F99AF0A311F848040FA11660E2CB755562CFE9
                                                          Function 00A998B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetSysColor.USER32(00000008), ref: 00A998CC
                                                          • SetTextColor.GDI32(?,?), ref: 00A998D6
                                                          • SetBkMode.GDI32(?,00000001), ref: 00A998E9
                                                          • GetStockObject.GDI32(00000005), ref: 00A998F1
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Color$ModeObjectStockText
                                                          • String ID:
                                                          • API String ID: 4037423528-0
                                                          • Opcode ID: 23c1f9a1639bd2078d4ec6702b1577dce1b964eca1d479f570554133c909358f
                                                          • Instruction ID: 2cb40900c98affeaa04e82d4951786373fe716d6727e6d553ec8b5b3589f9c45
                                                          • Opcode Fuzzy Hash: 23c1f9a1639bd2078d4ec6702b1577dce1b964eca1d479f570554133c909358f
                                                          • Instruction Fuzzy Hash: 0AE06D312C4280BADB215B78BC09BED3F61AB12336F14C21AF6FA690E1CB7146509B11
                                                          Function 00AE162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetCurrentThread.KERNEL32 ref: 00AE1634
                                                          • OpenThreadToken.ADVAPI32(00000000,?,?,?,00AE11D9), ref: 00AE163B
                                                          • GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00AE11D9), ref: 00AE1648
                                                          • OpenProcessToken.ADVAPI32(00000000,?,?,?,00AE11D9), ref: 00AE164F
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: CurrentOpenProcessThreadToken
                                                          • String ID:
                                                          • API String ID: 3974789173-0
                                                          • Opcode ID: a12d81bebd1b4533a93e0126f7ace81b63c1ccab4a4a1abd9b28f497464ead59
                                                          • Instruction ID: 62e9f2d609b2f771d30f631269f79544377d852cace0ea481e514b0908593791
                                                          • Opcode Fuzzy Hash: a12d81bebd1b4533a93e0126f7ace81b63c1ccab4a4a1abd9b28f497464ead59
                                                          • Instruction Fuzzy Hash: F8E08631641221DBD7202FA1AD0DBC63F7CBF45795F14C808F245CB080DA344540C754
                                                          Function 00ADD858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetDesktopWindow.USER32 ref: 00ADD858
                                                          • GetDC.USER32(00000000), ref: 00ADD862
                                                          • GetDeviceCaps.GDI32(00000000,0000000C), ref: 00ADD882
                                                          • ReleaseDC.USER32(?), ref: 00ADD8A3
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: CapsDesktopDeviceReleaseWindow
                                                          • String ID:
                                                          • API String ID: 2889604237-0
                                                          • Opcode ID: 63b70cb8b337c1237aaab46e39640a08b40c29c9fa3ada48e7f3376cc19abcba
                                                          • Instruction ID: 47df62f2fdd0fc0fa3c44e057940a52211bcfb766e1bf829168e6c43f43702fe
                                                          • Opcode Fuzzy Hash: 63b70cb8b337c1237aaab46e39640a08b40c29c9fa3ada48e7f3376cc19abcba
                                                          • Instruction Fuzzy Hash: 4AE012B4840204EFCF41AFA0D90CAADBFB2FB08310F60D009E80AE7250CB388A41EF50
                                                          Function 00ADD86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetDesktopWindow.USER32 ref: 00ADD86C
                                                          • GetDC.USER32(00000000), ref: 00ADD876
                                                          • GetDeviceCaps.GDI32(00000000,0000000C), ref: 00ADD882
                                                          • ReleaseDC.USER32(?), ref: 00ADD8A3
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: CapsDesktopDeviceReleaseWindow
                                                          • String ID:
                                                          • API String ID: 2889604237-0
                                                          • Opcode ID: 980bcc27c3d7f91dee28e973223a1226f8abce5e6d2295ab376f30973c1b3388
                                                          • Instruction ID: 3a59e6db21bd869b58a5e74a9f9b015398c77a5b155c3dc9ab3265aa2c149902
                                                          • Opcode Fuzzy Hash: 980bcc27c3d7f91dee28e973223a1226f8abce5e6d2295ab376f30973c1b3388
                                                          • Instruction Fuzzy Hash: 48E092B5D40204EFCF51AFA0D94C6ADBFB5BB08311B549449E94AE7250CB385A41EF50
                                                          Function 00AF4D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00A87620: _wcslen.LIBCMT ref: 00A87625
                                                          • WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00AF4ED4
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Connection_wcslen
                                                          • String ID: *$LPT
                                                          • API String ID: 1725874428-3443410124
                                                          • Opcode ID: 40386a0da1a9c1233c2de054470dbd89c0e023f08b6282a386d13910be39c6d5
                                                          • Instruction ID: 4cedac2c7433002cade8e7407ab77220909dbb08c861549711edc20359a055ba
                                                          • Opcode Fuzzy Hash: 40386a0da1a9c1233c2de054470dbd89c0e023f08b6282a386d13910be39c6d5
                                                          • Instruction Fuzzy Hash: 72916D75A002089FCB14DF98C584EAABBF1BF48704F188099F94A9F362D731ED85CB90
                                                          Function 00AAE27D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • __startOneArgErrorHandling.LIBCMT ref: 00AAE30D
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: ErrorHandling__start
                                                          • String ID: pow
                                                          • API String ID: 3213639722-2276729525
                                                          • Opcode ID: 6b08328f2cbd3a768d6c35b419a72a8f644e1ae095e136f41b4dafc66f9caefd
                                                          • Instruction ID: ff8a8bf960050d990880c8c5d85093c2e86a83ff9d01bc8f0c718ee9acc2b030
                                                          • Opcode Fuzzy Hash: 6b08328f2cbd3a768d6c35b419a72a8f644e1ae095e136f41b4dafc66f9caefd
                                                          • Instruction Fuzzy Hash: E9512B71A0C20296CF15F718CA417FD3BACAF81780F344D98E096872EAEF758C959A56
                                                          Function 00A9E187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: #
                                                          • API String ID: 0-1885708031
                                                          • Opcode ID: 4f9745b836c850abcc94e22845c01d4737a728ad17069356660ec6b3f878ff09
                                                          • Instruction ID: b9e308044d0e92b5feb3af82c1b4279b8d7009aa6e2a02031fa4b38d8e70b333
                                                          • Opcode Fuzzy Hash: 4f9745b836c850abcc94e22845c01d4737a728ad17069356660ec6b3f878ff09
                                                          • Instruction Fuzzy Hash: 1F51F175A04246DFDF15EF68C481AFA7BB8EF65310F24405AE8929F3D1DA349D42CBA0
                                                          Function 00A9F291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • Sleep.KERNEL32(00000000), ref: 00A9F2A2
                                                          • GlobalMemoryStatusEx.KERNEL32(?), ref: 00A9F2BB
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: GlobalMemorySleepStatus
                                                          • String ID: @
                                                          • API String ID: 2783356886-2766056989
                                                          • Opcode ID: 3e04200a84c0a28bc5db054fd99e746fbb6adfdf79b0a62dd6f78b0f8fd1214f
                                                          • Instruction ID: b56842a9a52dac5e9755d844b4559579e16eca8998d5634edfffa322aca9e7b0
                                                          • Opcode Fuzzy Hash: 3e04200a84c0a28bc5db054fd99e746fbb6adfdf79b0a62dd6f78b0f8fd1214f
                                                          • Instruction Fuzzy Hash: 375158714087449BE320AF14ED86BAFBBF8FF84314F91884DF2D951195EB308929CB66
                                                          Function 00B05745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 00B057E0
                                                          • _wcslen.LIBCMT ref: 00B057EC
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: BuffCharUpper_wcslen
                                                          • String ID: CALLARGARRAY
                                                          • API String ID: 157775604-1150593374
                                                          • Opcode ID: fbe4e43f3dcd72b4c8db06beb1e997c85a325548395c563cfd0938338e898d9d
                                                          • Instruction ID: 306db88396470623a79a457c240fdfcac46863aa616754723ca019f59d92bb4e
                                                          • Opcode Fuzzy Hash: fbe4e43f3dcd72b4c8db06beb1e997c85a325548395c563cfd0938338e898d9d
                                                          • Instruction Fuzzy Hash: 34418F31A006099FCB14DFA9C9859BEBBF9EF59350F1480A9E905A7291EB70DD81CF90
                                                          Function 00AFD0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • _wcslen.LIBCMT ref: 00AFD130
                                                          • InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00AFD13A
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: CrackInternet_wcslen
                                                          • String ID: |
                                                          • API String ID: 596671847-2343686810
                                                          • Opcode ID: 29eacb24e421cec4f35ef6264e2d5d3ef65d0b94b61ee2501ef735229efe15fb
                                                          • Instruction ID: 7cd27ef544fda1af982c9116655a919ef2b8c6432e83e7ba100c2b0c80fcc86f
                                                          • Opcode Fuzzy Hash: 29eacb24e421cec4f35ef6264e2d5d3ef65d0b94b61ee2501ef735229efe15fb
                                                          • Instruction Fuzzy Hash: 81313E71D00209ABDF15EFE4CD85AEEBFBAFF05300F000119F915A6165E731AA56DB64
                                                          Function 00B1356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • DestroyWindow.USER32(?,?,?,?), ref: 00B13621
                                                          • MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00B1365C
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Window$DestroyMove
                                                          • String ID: static
                                                          • API String ID: 2139405536-2160076837
                                                          • Opcode ID: 378a46b8fc39d3c6c171654afb77e20a65cc998d7373d4af5f0492fa85b724ac
                                                          • Instruction ID: 7a381924f0126c8c612731a38aef9ad43b7ed771e93fa57426dfd0e8b16c20fd
                                                          • Opcode Fuzzy Hash: 378a46b8fc39d3c6c171654afb77e20a65cc998d7373d4af5f0492fa85b724ac
                                                          • Instruction Fuzzy Hash: AA319E71100204AEEB109F28DC80FFB73E9FF98B64F508619F9A597290DA30AD91C760
                                                          Function 00B14537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SendMessageW.USER32(00000027,00001132,00000000,?), ref: 00B1461F
                                                          • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00B14634
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: MessageSend
                                                          • String ID: '
                                                          • API String ID: 3850602802-1997036262
                                                          • Opcode ID: dedc2322882a607ec1043d0423c9e9d56c1926f0d93f4b0f4b0389d4a95a6203
                                                          • Instruction ID: 4d92ea4e928e208d882ca1c8ab252e6f621da106a7ab9440e3127c16216985e5
                                                          • Opcode Fuzzy Hash: dedc2322882a607ec1043d0423c9e9d56c1926f0d93f4b0f4b0389d4a95a6203
                                                          • Instruction Fuzzy Hash: 03311674A0020A9FDF14CFA9C980BDA7BF6FB19304F5444AAE904AB341D770A981CF90
                                                          Function 00B131EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00B1327C
                                                          • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00B13287
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: MessageSend
                                                          • String ID: Combobox
                                                          • API String ID: 3850602802-2096851135
                                                          • Opcode ID: 56b7fa2e1c6ad39d52cac01c21ad6195df610035f758ce4d743d9f4dc7bd7d08
                                                          • Instruction ID: 53882d87cff31623f933b09403412f7b4ecc0595fa98c607630864633cbebaa2
                                                          • Opcode Fuzzy Hash: 56b7fa2e1c6ad39d52cac01c21ad6195df610035f758ce4d743d9f4dc7bd7d08
                                                          • Instruction Fuzzy Hash: B511B2713002087FFF21AE54DC80EFB3BEAEB98764F504164F918A7290E6319D9187A0
                                                          Function 00B13710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00A8600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00A8604C
                                                            • Part of subcall function 00A8600E: GetStockObject.GDI32(00000011), ref: 00A86060
                                                            • Part of subcall function 00A8600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 00A8606A
                                                          • GetWindowRect.USER32(00000000,?), ref: 00B1377A
                                                          • GetSysColor.USER32(00000012), ref: 00B13794
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Window$ColorCreateMessageObjectRectSendStock
                                                          • String ID: static
                                                          • API String ID: 1983116058-2160076837
                                                          • Opcode ID: b8b4084e399041024a838f210547763b09e644b6152bd47ef55744c236e474f7
                                                          • Instruction ID: 2b02397816be642be00fd4dbd5c6ae68816a7c1c597e3e76db34dba2bcba12bb
                                                          • Opcode Fuzzy Hash: b8b4084e399041024a838f210547763b09e644b6152bd47ef55744c236e474f7
                                                          • Instruction Fuzzy Hash: 461137B2610209AFDF01DFA8CC46EEA7BF8FB08714F404954F955E3250EB35E8619B60
                                                          Function 00AFCD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00AFCD7D
                                                          • InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00AFCDA6
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Internet$OpenOption
                                                          • String ID: <local>
                                                          • API String ID: 942729171-4266983199
                                                          • Opcode ID: bd163f0ef1fb2529d547fa116c432cf770f4eea48050162a826defa563346eb0
                                                          • Instruction ID: 8298fa73180333a4fbb2e0e5f0aa04c8b4b1d34335fe34029f73749cb323185b
                                                          • Opcode Fuzzy Hash: bd163f0ef1fb2529d547fa116c432cf770f4eea48050162a826defa563346eb0
                                                          • Instruction Fuzzy Hash: 4E11C27124563DBAD7384BA78C49EFBBEACEF127B4F40422AB20983080D7709941D6F0
                                                          Function 00B13429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetWindowTextLengthW.USER32(00000000), ref: 00B134AB
                                                          • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00B134BA
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: LengthMessageSendTextWindow
                                                          • String ID: edit
                                                          • API String ID: 2978978980-2167791130
                                                          • Opcode ID: 698ac6083e2a317bacaae59bf48c6f52c202edadd96caca34e2cd2de59a08edf
                                                          • Instruction ID: 26cddfcb56284b7365fc855b9dafc8239dd521b9aaa4b728af2a57d25c399cb8
                                                          • Opcode Fuzzy Hash: 698ac6083e2a317bacaae59bf48c6f52c202edadd96caca34e2cd2de59a08edf
                                                          • Instruction Fuzzy Hash: 2811BF71100208AFEB228E64DC80AEB3BEAEB14B74F908364FA65932E0D731DCD19750
                                                          Function 00AE6C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00A89CB3: _wcslen.LIBCMT ref: 00A89CBD
                                                          • CharUpperBuffW.USER32(?,?,?), ref: 00AE6CB6
                                                          • _wcslen.LIBCMT ref: 00AE6CC2
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: _wcslen$BuffCharUpper
                                                          • String ID: STOP
                                                          • API String ID: 1256254125-2411985666
                                                          • Opcode ID: 119a9923c767e30e8cbe9a0c501109e4e5afc65f942f010a4c07b2fef02cf569
                                                          • Instruction ID: 73397bbb514a74dc60eb0c35c2a0477fc45db645796b1aeabfa581dfc0dfbe4a
                                                          • Opcode Fuzzy Hash: 119a9923c767e30e8cbe9a0c501109e4e5afc65f942f010a4c07b2fef02cf569
                                                          • Instruction Fuzzy Hash: E90104326009668BCB20AFBECC908BF77B5FAB57907600D28E86293191EB31D900C750
                                                          Function 00AE1CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00A89CB3: _wcslen.LIBCMT ref: 00A89CBD
                                                            • Part of subcall function 00AE3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00AE3CCA
                                                          • SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00AE1D4C
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: ClassMessageNameSend_wcslen
                                                          • String ID: ComboBox$ListBox
                                                          • API String ID: 624084870-1403004172
                                                          • Opcode ID: eaf1fd8aaccb4dfd4b630a988e19747808662b4ac6436ae9aad2398c06e71741
                                                          • Instruction ID: 665c46336464af906f79be9e7e0cfe5f1bcc292fa6ee1c6bec0dd93439e218de
                                                          • Opcode Fuzzy Hash: eaf1fd8aaccb4dfd4b630a988e19747808662b4ac6436ae9aad2398c06e71741
                                                          • Instruction Fuzzy Hash: 7101D471601228ABCF18FFA5CE95CFF77A8EB46350B540619F832672D2EA3199088761
                                                          Function 00AE1BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00A89CB3: _wcslen.LIBCMT ref: 00A89CBD
                                                            • Part of subcall function 00AE3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00AE3CCA
                                                          • SendMessageW.USER32(?,00000180,00000000,?), ref: 00AE1C46
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: ClassMessageNameSend_wcslen
                                                          • String ID: ComboBox$ListBox
                                                          • API String ID: 624084870-1403004172
                                                          • Opcode ID: 598064eba1f80a2f16d6df52d332ae60dbd165afbf0f9f41fc45d86bc05864c4
                                                          • Instruction ID: 219521cfae22db2279b7fef0fda3adbc69c3333d3cfd8ff37cd05422bdec20ef
                                                          • Opcode Fuzzy Hash: 598064eba1f80a2f16d6df52d332ae60dbd165afbf0f9f41fc45d86bc05864c4
                                                          • Instruction Fuzzy Hash: 1B01A7757811586BCF14FB91CA559FF77A89B51340F240019F416B7282EA319F1C97B2
                                                          Function 00AE1C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00A89CB3: _wcslen.LIBCMT ref: 00A89CBD
                                                            • Part of subcall function 00AE3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00AE3CCA
                                                          • SendMessageW.USER32(?,00000182,?,00000000), ref: 00AE1CC8
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: ClassMessageNameSend_wcslen
                                                          • String ID: ComboBox$ListBox
                                                          • API String ID: 624084870-1403004172
                                                          • Opcode ID: f9bf0c6750e43ec6285a55d51edcb798858120b8439cad826b36c913a8f2bd3b
                                                          • Instruction ID: ca1a386c1dc668e9590e563cdfbccb3132252fc6197b4994ff35c2c98e45c49f
                                                          • Opcode Fuzzy Hash: f9bf0c6750e43ec6285a55d51edcb798858120b8439cad826b36c913a8f2bd3b
                                                          • Instruction Fuzzy Hash: DB01D6B16811686BCF14FBA2CB05AFF77E89B51340F240415B802B3282EA319F18D772
                                                          Function 00AE1D68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00A89CB3: _wcslen.LIBCMT ref: 00A89CBD
                                                            • Part of subcall function 00AE3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00AE3CCA
                                                          • SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 00AE1DD3
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: ClassMessageNameSend_wcslen
                                                          • String ID: ComboBox$ListBox
                                                          • API String ID: 624084870-1403004172
                                                          • Opcode ID: 0c2157a63edde5619c2b3b39d67c49d48f6d6705c54b0436aa6e0007e351a88b
                                                          • Instruction ID: 489ad511cf2ce2fb7fe2fd73e059bd35f7da742797b1cbfa90c87b61eca47014
                                                          • Opcode Fuzzy Hash: 0c2157a63edde5619c2b3b39d67c49d48f6d6705c54b0436aa6e0007e351a88b
                                                          • Instruction Fuzzy Hash: E5F0A971A416296BDB14F7A5CD95AFF77B8AB01350F580915F422632C1EA715A088361
                                                          Function 00B0747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: _wcslen
                                                          • String ID: 3, 3, 16, 1
                                                          • API String ID: 176396367-3042988571
                                                          • Opcode ID: e49a2f2a9c59cc032bcc90ec9b0c28ec3425cdaff8527021fe5f461c41f1d59b
                                                          • Instruction ID: 745ef6143674f96a0bf42f71bb34a4b558e4dab131f13032db4a5466ad9372dd
                                                          • Opcode Fuzzy Hash: e49a2f2a9c59cc032bcc90ec9b0c28ec3425cdaff8527021fe5f461c41f1d59b
                                                          • Instruction Fuzzy Hash: A7E02B02A5426010D23116799DC197FDBCDCFCA790710186BF981C33E6EFD49DA293A0
                                                          Function 00AE0B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00AE0B23
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Message
                                                          • String ID: AutoIt$Error allocating memory.
                                                          • API String ID: 2030045667-4017498283
                                                          • Opcode ID: 7d38cbad8cd2bebb223f00b791f10dd6e76d0b89b9599c7c44833a4574d18d7d
                                                          • Instruction ID: d8fb56594544b2b1fded4cc428a578748b20f5e7c5c64156763abb95710a9a38
                                                          • Opcode Fuzzy Hash: 7d38cbad8cd2bebb223f00b791f10dd6e76d0b89b9599c7c44833a4574d18d7d
                                                          • Instruction Fuzzy Hash: D3E0D8323843082BD62037547D03FC97EC58F06F50F10046AF748954D38BD1299006E9
                                                          Function 00AA0D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00A9F7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00AA0D71,?,?,?,00A8100A), ref: 00A9F7CE
                                                          • IsDebuggerPresent.KERNEL32(?,?,?,00A8100A), ref: 00AA0D75
                                                          • OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00A8100A), ref: 00AA0D84
                                                          Strings
                                                          • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00AA0D7F
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
                                                          • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
                                                          • API String ID: 55579361-631824599
                                                          • Opcode ID: 27ac9a6d10525efad39fd3a1c923147eaf3fa8b29a605ac1398f9841a3ac4c9a
                                                          • Instruction ID: 8d8519b1d8ecbda90ec3b10d69f21ca8bd2507eca54254e0fff6f67d2f72f5d3
                                                          • Opcode Fuzzy Hash: 27ac9a6d10525efad39fd3a1c923147eaf3fa8b29a605ac1398f9841a3ac4c9a
                                                          • Instruction Fuzzy Hash: C9E06D752007018BD360AFBCD508B927BE0AB01740F40896DE486C76A1EBB5E488CB91
                                                          Function 00AF3017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetTempPathW.KERNEL32(00000104,?,00000001), ref: 00AF302F
                                                          • GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00AF3044
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: Temp$FileNamePath
                                                          • String ID: aut
                                                          • API String ID: 3285503233-3010740371
                                                          • Opcode ID: ad50417d46135138b446c25fe3e4587a781bdfdfd676af17e440be1b22442af5
                                                          • Instruction ID: 86746fb37b56eb8fefe5b2c17effc3894ee379a6ecefb47183f40609f7894a66
                                                          • Opcode Fuzzy Hash: ad50417d46135138b446c25fe3e4587a781bdfdfd676af17e440be1b22442af5
                                                          • Instruction Fuzzy Hash: EBD05EB254032867DA20A7A4AC0EFCB3F6CDB05750F4002A1B655E30A1DEF09A84CAD0
                                                          Function 00ADD21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: LocalTime
                                                          • String ID: %.3d$X64
                                                          • API String ID: 481472006-1077770165
                                                          • Opcode ID: 7f4fac8a890df5a8ebe4aa9759a77435b8a1733c5a31bfad8bd6b1052e71c719
                                                          • Instruction ID: b1c19c2a58f15eefcadee1f373d5d5bcf97f02691a01ebd19a08c6b7c94d982d
                                                          • Opcode Fuzzy Hash: 7f4fac8a890df5a8ebe4aa9759a77435b8a1733c5a31bfad8bd6b1052e71c719
                                                          • Instruction Fuzzy Hash: 69D012B1948108EACF509AD0CC458F9B7BCEB18341F508453F807D2140DA34C649A761
                                                          Function 00B12322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00B1232C
                                                          • PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00B1233F
                                                            • Part of subcall function 00AEE97B: Sleep.KERNEL32 ref: 00AEE9F3
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: FindMessagePostSleepWindow
                                                          • String ID: Shell_TrayWnd
                                                          • API String ID: 529655941-2988720461
                                                          • Opcode ID: 365d9ab950a8d9884e1585f13e1b41ff7df4ee727b2e52f10f5b07376c800ace
                                                          • Instruction ID: e3963a4e3850132c5d4840c69aae7d489397bc6ac85026c279900e0dcb4ec2ec
                                                          • Opcode Fuzzy Hash: 365d9ab950a8d9884e1585f13e1b41ff7df4ee727b2e52f10f5b07376c800ace
                                                          • Instruction Fuzzy Hash: FDD0C9363D4350BAE664A771DC0FFC6AA55AB10B10F4089167645AB1E5D9A0A841CA54
                                                          Function 00B12356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00B1236C
                                                          • PostMessageW.USER32(00000000), ref: 00B12373
                                                            • Part of subcall function 00AEE97B: Sleep.KERNEL32 ref: 00AEE9F3
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: FindMessagePostSleepWindow
                                                          • String ID: Shell_TrayWnd
                                                          • API String ID: 529655941-2988720461
                                                          • Opcode ID: 11a4a1d4c6d0d75e840cd0ddec41532591853267d833888d8dda7e8f1ddfabb0
                                                          • Instruction ID: 495225f42807eea0a4879174ba6ca9f06c53ad80cde0763d134e232db5fb695d
                                                          • Opcode Fuzzy Hash: 11a4a1d4c6d0d75e840cd0ddec41532591853267d833888d8dda7e8f1ddfabb0
                                                          • Instruction Fuzzy Hash: 2AD0C9323C13507AE664A771DC0FFC6AA55AB15B10F4089167645AB1E5D9A0A841CA54
                                                          Function 00ABBDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          • MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 00ABBE93
                                                          • GetLastError.KERNEL32 ref: 00ABBEA1
                                                          • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00ABBEFC
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.2926331716.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                          • Associated: 00000000.00000002.2926291821.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B1C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926435444.0000000000B42000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926528777.0000000000B4C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.2926560338.0000000000B54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_a80000_file.jbxd
                                                          Similarity
                                                          • API ID: ByteCharMultiWide$ErrorLast
                                                          • String ID:
                                                          • API String ID: 1717984340-0
                                                          • Opcode ID: cc0a370344734d7aa52872d76794b1a93c6ac4341fbc7a1cac0489ce2b410d7d
                                                          • Instruction ID: f15a88f4a4c485231cbe407fd02426fcad01551f52f3516e4e38ce680390d154
                                                          • Opcode Fuzzy Hash: cc0a370344734d7aa52872d76794b1a93c6ac4341fbc7a1cac0489ce2b410d7d
                                                          • Instruction Fuzzy Hash: 1441C334610206AFCF258FB5CD44AFA7BADAF42310F244169F9599B1A2DBB0CD01DB70